registry / @caeliq/llms / 1.0.66
@caeliq/llms@1.0.66
A universal LLM API transformation server
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe bundles contain guarded Cursor workspace configuration behavior that can influence agent tool execution. No install-time trigger or concrete malicious behavior was established, so this merits a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A Cursor SDK bridge workspace is created or its guidance changes during server operation.
Impact
The generated hooks can affect how Cursor handles tools, shell commands, file reads, and MCP operations in that workspace.
Mechanism
The bundle writes hook scripts and hook configuration beneath .cursor, then writes bridge guidance to AGENTS.md.
AI rationale
The bundles contain guarded Cursor workspace configuration behavior that can influence agent tool execution. No install-time trigger or concrete malicious behavior was established, so this merits a warning rather than a block.
Evidence
dist/cjs/server.cjsdist/esm/server.mjs.cursor/hooks/deny-builtin.cjs.cursor/hooks.jsonAGENTS.md
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exports the CommonJS and ESM server bundles as its entrypoints.
- Both bundles create Cursor hook files under a .cursor directory and register hooks for tool use, shell, file reads, and MCP.
- The bridge also writes an AGENTS.md file in its workspace; this is agent configuration mutation.
- The related sandbox behavior is gated by an explicit setting and disabled in detected container environments.
Evidence against
- The manifest contains no install lifecycle scripts, so the configuration behavior is not shown to run during npm installation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
11 flaggeddist/cjs/server.cjsView file
1Trigger-reachable chain: manifest.main -> dist/cjs/server.cjs
L1: "use strict";var BO=Object.create;var ru=Object.defineProperty;var UO=Object.getOwnPropertyDescriptor;var jO=Object.getOwnPropertyNames;var LO=Object.getPrototypeOf,$O=Object.proto...
L2: -- Key to operate on
...
L58: `:case"\u2028":case"\u2029":return Y(),"";case"\r":return Y(),hr()===`
L59: `&&Y(),"";case"1":case"2":case"3":case"4":case"5":case"6":case"7":case"8":case"9":throw qe(Y());case void 0:throw qe(Y())}return Y()}function t1(){let t="",e=hr();if(!at.isHexDigit...
L60: `+s;A=S.join(x),k=`{
...
L64: `+s+A+`,
L65: `+w+"]"}return o.pop(),s=w,S}}});var tg=G((H6,Jw)=>{var o1=zw(),s1=Gw(),i1={parse:o1,stringify:s1};Jw.exports=i1});var QS=G((G3,hF)=>{hF.exports={"0":"\u2080","1":"\u2081","2":"\u2...
L66: `)||r,code:s,statu
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cjs/server.cjsView on unpkg · L1•matchType = previous_version_dangerous_delta
matchedPackage = @caeliq/llms@1.0.69
matchedIdentity = npm:QGNhZWxpcS9sbG1z:1.0.69
similarity = 0.667
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cjs/server.cjsView on unpkgFindings
3 Critical7 High4 Medium3 Low
CriticalCredential Exfiltrationdist/esm/server.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/cjs/server.cjs
CriticalPrevious Version Dangerous Deltadist/cjs/server.cjs
HighChild Processdist/cjs/server.cjs
HighSame File Env Network Executiondist/esm/server.mjs
HighCommand Output Exfiltrationdist/esm/server.mjs
HighCloud Metadata Accessdist/esm/server.mjs
HighCopied Package Dependency Bridgedist/esm/server.mjs
HighTrigger Reachable Credential Exfiltrationdist/cjs/server.cjs
HighTrigger Reachable Command Output Exfiltrationdist/cjs/server.cjs
MediumDynamic Requiredist/cjs/server.cjs
Affected versions and remediation
This report applies to @caeliq/llms@1.0.66.
See all versions of @caeliq/llms for other recorded verdicts.
- Review the evidence and your use of @caeliq/llms@1.0.66 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.