agentic-relay@5.6.0
Install Agent Relay across 17+ agents — Claude Code, Codex, Cursor, Gemini CLI, Goose, Windsurf, Cline, BoltAI, Claude Desktop, VS Code, Amazon Q, Roo Code, Witsy, LibreChat, OpenClaw, Tome, Raycast — hire verified expert agents to build with you, plus th
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package has no install hook and the credential traffic inspected is directed to its own service. The installer nevertheless sends account-linked information about installed agent surfaces by default without an evident opt-out, so this is suspicious telemetry.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the installer CLI and at least one agent integration is installed.
Impact
The service can associate which agent integrations were installed with the user’s Agent Relay account.
Mechanism
The installer reports selected client IDs and labels to the CLI-auth endpoint, authenticating with the existing Agent Relay API key. No opt-out was found in the inspected flow.
AI rationale
The package has no install hook and the credential traffic inspected is directed to its own service. The installer nevertheless sends account-linked information about installed agent surfaces by default without an evident opt-out, so this is suspicious telemetry.
Evidence
bin/install.mjsbin/lib/surfaces.mjs~/.config/agent-relay/credentials.json~/.config/agent-relay/update-check.jsonselected agent configuration paths
Network endpoints3
peruwnbrqkvmrldhpoom.supabase.co/functions/v1/cli-authperuwnbrqkvmrldhpoom.supabase.co/functions/v1/api-v1registry.npmjs.org/agentic-relay/latest
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest declares no install lifecycle hook; it exposes a CLI entry point.
- The installer sends an authenticated report after installing selected agent integrations, without an evident opt-out.
- The report contains only the selected client IDs and labels, and uses the package’s own Supabase service endpoint.
- The CLI’s API key is sent to the package’s own API host; no credential forwarding to an unrelated host was identified.
Evidence against
- The report runs only when a user invokes the installer, rather than during package-manager installation or ordinary CLI startup.
- The report identifies installed agent surfaces; the inspected code does not include hostnames, usernames, local paths, or file contents in it.
- The installer’s global CLI relink targets this package itself, and the update check fetches package version data from the npm registry.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
5 flaggedbin/lib/update-check.mjsView file
17import { join, dirname, sep } from "path";
L18: import { spawn } from "child_process";
L19: import { fileURLToPath } from "url";
High
Child Process
Package source references child process execution.
bin/lib/update-check.mjsView on unpkg · L17bin/lib/cache.mjsView file
31try {
L32: return JSON.parse(readFileSync(path, "utf-8"));
L33: } catch {
Low
Weak Crypto
Package source references weak cryptographic algorithms.
bin/lib/cache.mjsView on unpkg · L31bin/install.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = agentic-relay@5.0.8
matchedIdentity = npm:YWdlbnRpYy1yZWxheQ:5.0.8
similarity = 0.538
summary = stored previous version shares package body but lacks this dangerous source file
Findings
1 Critical4 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltabin/install.mjs
HighChild Processbin/lib/update-check.mjs
HighShell
HighRuntime Package Installbin/install.mjs
HighSemantic Analysis Limitedbin/install.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptobin/lib/cache.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to agentic-relay@5.6.0.
See all versions of agentic-relay for other recorded verdicts.
- Review the evidence and your use of agentic-relay@5.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.