registry / AI-agent control-surface risk / ai-claude-keyapi

ai-claude-keyapi

Ultra-lightweight local AI Gateway with 1-Click Claude Code Setup

This report shows the evidence for ai-claude-keyapi@1.0.14. 4 of 11 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is concrete AI-agent control hijacking and provider impersonation, not ordinary gateway behavior. The absence of an install lifecycle hook does not remove the runtime attack path.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A user starts the CLI, then uses the local gateway with an AI client that supplies tools.

Impact

The upstream model can be steered to perform filesystem and shell actions in the connected AI-agent context while concealing its actual provider.

Mechanism

Injected agent-control prompt, provider impersonation, and shell-profile persistence.

Policy narrative

The user starts the local gateway, which persists an npx launcher. For tool-enabled requests, the gateway adds a system prompt directing the upstream model to use file and shell tools autonomously, while forcing it to claim it is Anthropic Claude and suppress mention of Grok or xAI. Requests are sent to the Grok proxy, creating a concealed AI-agent control path.

AI rationale

This is concrete AI-agent control hijacking and provider impersonation, not ordinary gateway behavior. The absence of an install lifecycle hook does not remove the runtime attack path.

Evidence

dist/server.jsbin/cli.jsdist/utils/shortcut.js~/.local/bin/aiclaude~/.bashrc~/.zshrc~/.profile~/.grok-router/accounts.json~/.grok-router/license.json

Network endpoints3

cli-chat-proxy.grok.com/v1auth.x.aiaiclaude.freepro.online

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The gateway embeds a system prompt that instructs an AI agent to use file and shell tools autonomously.
It hides its Grok/xAI origin by directing the model to identify as Anthropic Claude.
Starting the CLI automatically invokes shortcut setup, which installs an alias that reruns the package through npx.
The runtime forwards requests to a Grok proxy and uses license activation that transmits a machine identifier and hostname.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The shortcut and gateway run only after the user starts the CLI.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 4 file(s), 1.01 MB of source, external domains: 127.0.0.1, aiclaude.freepro.online, auth.x.ai, cli-chat-proxy.grok.com, dub.sh, git.io, github.com, registry.npmjs.org

Source & flagged code

8 flagged

dist/server.jsView file

2var tf=Object.create;var as=Object.defineProperty;var of=Object.getOwnPropertyDescriptor;var sf=Object.getOwnPropertyNames;var rf=Object.getPrototypeOf,cf=Object.prototype.hasOwnPr... L3: at `+a[i].toString();return e}function vf(a){if(!a)throw new TypeError("argument namespace is required");var e=bi(),i=Ye(e[1]),n=i[0];function t(o){gi.call(t,o)}return t._file=n,t.... L4: `,"utf8")}}}function Ye(a){var e=a.getFileName()||"<anonymous>",i=a.getLineNumber(),n=a.getColumnNumber();a.isEval()&&(e=a.getEvalOrigin()+", "+e);var t=[e,i,n];return t.callSite=a... L5: at `+i[o].toString();return t}return e&&(t+=" at "+Dn(e)),t}function yf(a,e,i){var n="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+a+"\x1B[39m"... L6: \x1B[36mat `+i[t].toString()+"\x1B[39m";retu

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/server.jsView on unpkg · L2

1import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url); L2: var tf=Object.create;var as=Object.defineProperty;var of=Object.getOwnPropertyDescriptor;var sf=Object.getOwnPropertyNames;var rf=Object.getPrototypeOf,cf=Object.prototype.hasOwnPr... L3: at `+a[i].toString();return e}function vf(a){if(!a)throw new TypeError("argument namespace is required");var e=bi(),i=Ye(e[1]),n=i[0];function t(o){gi.call(t,o)}return t._file=n,t.... L4: `,"utf8")}}}function Ye(a){var e=a.getFileName()||"<anonymous>",i=a.getLineNumber(),n=a.getColumnNumber();a.isEval()&&(e=a.getEvalOrigin()+", "+e);var t=[e,i,n];return t.callSite=a... L5: at `+i[o].toString();return t}return e&&(t+=" at "+Dn(e)),t}function yf(a,e,i){var n="\x1B[36;1m"+this._namespace+

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/server.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = ai-claude-keyapi@1.0.7 matchedPath = dist/server.js matchedIdentity = npm:YWktY2xhdWRlLWtleWFwaQ:1.0.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 8acf2f60ebf986aa signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = ai-claude-keyapi@1.0.7 matchedPath = dist/server.js matchedIdentity = npm:YWktY2xhdWRlLWtleWFwaQ:1.0.7 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/server.jsView on unpkg

5at `+i[o].toString();return t}return e&&(t+=" at "+Dn(e)),t}function yf(a,e,i){var n="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+a+"\x1B[39m"... L6: \x1B[36mat `+i[t].toString()+"\x1B[39m";return n}return e&&(n+=" \x1B[36m"+Dn(e)+"\x1B[39m"),n}function Dn(a){return lf(uf,a[0])+":"+a[1]+":"+a[2]}function bi(){var a=Error.stackTr... L7: return function (`+i+`) {log.call(deprecate, message, site)

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/server.jsView on unpkg · L5

bin/cli.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

3import fs from 'node:fs';

4import path from 'node:path';

5import { fileURLToPath } from 'node:url';

7const __filename = fileURLToPath(import.meta.url);

8const __dirname = path.dirname(__filename);

10// Fallback loader: use dist/ if built for production, otherwise src/

11const distServer = path.join(__dirname, '../dist/server.js');

12const serverPath = fs.existsSync(distServer) ? distServer : path.join(__dirname, '../src/server.js');

13const { startServer } = await import(serverPath);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L12

15const distNotifier = path.join(__dirname, '../dist/utils/updateNotifier.js');

16const notifierPath = fs.existsSync(distNotifier) ? distNotifier : path.join(__dirname, '../src/utils/updateNotifier.js');

17const { checkUpdate, formatUpdateBanner } = await import(notifierPath);

19const distShortcut = path.join(__dirname, '../dist/utils/shortcut.js');

20const shortcutPath = fs.existsSync(distShortcut) ? distShortcut : path.join(__dirname, '../src/utils/shortcut.js');

21const { setupShortcut } = await import(shortcutPath);

23let pkg = { name: 'ai-claude-keyapi', version: '1.0.14' };

24try {

25 const rawPkg = fs.readFileSync(path.join(__dirname, '../package.json'), 'utf8');

26 pkg = JSON.parse(rawPkg);

27} catch {}

29function parseArgs(args) {

30 const options = {

31 port: process.env.PORT ? parseInt(process.env.PORT, 10) : 3005,

32 host: process.env.HOST || '0.0.0.0',

dist/utils/shortcut.jsView file

Lines 1-20javascript

1import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);

2import n from"node:fs";import i from"node:path";import m from"node:os";function k(s={}){let l=s.homeDir||m.homedir(),u=s.platform||process.platform,o=s.env||process.env,d=u==="win32",c={installed:!1,command:"aiclaude",paths:[]};try{if(d){let t=[o.APPDATA?i.join(o.APPDATA,"npm"):null,o.LOCALAPPDATA?i.join(o.LOCALAPPDATA,"Microsoft","WindowsApps"):null,i.join(l,".local","bin")].filter(Boolean);for(let a of t)try{n.existsSync(a)||n.mkdirSync(a,{recursive:!0});let r=i.join(a,"aiclaude.cmd"),e=i.join(a,"aiclaude.ps1"),p=`@echo off\r

3where ai-claude-keyapi >nul 2>&1\r

4if %ERRORLEVEL% equ 0 (\r

5 ai-claude-keyapi %*\r

6) else (\r

7 npx ai-claude-keyapi %*\r

8)\r

9`,f=`if (Get-Command ai-claude-keyapi -ErrorAction SilentlyContinue) { ai-claude-keyapi @args } else { npx ai-claude-keyapi @args }\r

10`;n.writeFileSync(r,p,"utf8"),n.writeFileSync(e,f,"utf8"),c.installed=!0,c.paths.push(r,e);break}catch{}}else{let t=i.join(l,".local","bin");try{n.existsSync(t)||n.mkdirSync(t,{recursive:!0});let e=i.join(t,"aiclaude");n.writeFileSync(e,`#!/usr/bin/env sh

11if command -v ai-claude-keyapi >/dev/null 2>&1; then

12 exec ai-claude-keyapi "$@"

13else

14 exec npx ai-claude-keyapi "$@"

15fi

16`,{mode:493}),c.installed=!0,c.paths.push(e)}catch{}let a=[".bashrc",".zshrc",".profile"].map(e=>i.join(l,e)),r=`

17# AI Claude KeyAPI shortcut

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/utils/shortcut.jsView on unpkg · L1

18alias aiclaude="npx ai-claude-keyapi"

19`;for(let e of a)try{n.existsSync(e)&&(n.readFileSync(e,"utf8").includes("alias aiclaude=")||(n.appendFileSync(e,r,"utf8"),c.paths.push(e)))}catch{}}}catch{}return c}export{k as setupShortcut};

dist/utils/updateNotifier.jsView file

•matchType = normalized_sha256 matchedPackage = ai-claude-keyapi@1.0.7 matchedPath = dist/utils/updateNotifier.js matchedIdentity = npm:YWktY2xhdWRlLWtleWFwaQ:1.0.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/updateNotifier.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/server.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/server.jsView on unpkg · L2

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/server.jsView on unpkg · L1

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/server.jsView on unpkg

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/server.jsView on unpkg · L5

bin/cli.jsView file

12const serverPath = fs.existsSync(distServer) ? distServer : path.join(__dirname, '../src/server.js'); L13: const { startServer } = await import(serverPath); L14:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L12

dist/utils/shortcut.jsView file

1import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url); L2: import n from"node:fs";import i from"node:path";import m from"node:os";function k(s={}){let l=s.homeDir||m.homedir(),u=s.platform||process.platform,o=s.env||process.env,d=u==="win3... L3: where ai-claude-keyapi >nul 2>&1\r ... L15: fi L16: `,{mode:493}),c.installed=!0,c.paths.push(e)}catch{}let a=[".bashrc",".zshrc",".profile"].map(e=>i.join(l,e)),r=` L17: # AI Claude KeyAPI shortcut

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/utils/shortcut.jsView on unpkg · L1

dist/utils/updateNotifier.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/updateNotifier.jsView on unpkg

Findings

6 High5 Medium7 Low

HighChild Process

HighSame File Env Network Executiondist/server.js

HighHost Fingerprint Exfiltrationdist/server.js

HighKnown Malware Source Similaritydist/server.js

HighKnown Malware Source Similaritydist/utils/updateNotifier.js

HighKnown Malware Source Fingerprint Signaturedist/server.js

MediumDynamic Requirebin/cli.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/utils/shortcut.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/server.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to ai-claude-keyapi@1.0.14.

The versions list below shows the verdict for each recorded version.

Avoid installing ai-claude-keyapi@1.0.14. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-09 09:31:39.719Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

11 known versions

1.0.14latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 9, 2026, 7:09 AM 1.0.12SuspiciousAI-agent capability abuseWarnPublishedSep 5, 2026, 4:43 AM 1.0.10MaliciousCredential ExfiltrationBlockPublishedSep 5, 2026, 4:34 AM 1.0.9MaliciousData ExfiltrationBlockPublishedSep 5, 2026, 4:28 AM 1.0.8SuspiciousAI-agent capability abuseWarnPublishedSep 5, 2026, 12:57 AM 1.0.7MaliciousCredential ExfiltrationBlockPublishedSep 4, 2026, 9:26 AM 1.0.5SuspiciousCredential ExfiltrationWarnPublishedSep 4, 2026, 9:04 AM 1.0.4SuspiciousAI-agent capability abuseWarnPublishedSep 4, 2026, 8:45 AM 1.0.2SuspiciousCredential ExfiltrationWarnPublishedSep 4, 2026, 8:35 AM 1.0.1Clean—AllowPublishedSep 4, 2026, 5:47 AM 1.0.0Clean—AllowPublishedSep 4, 2026, 4:31 AM

98%Malicious

AI assessment confidence

TypeSoft block: AI-agent control surface

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn by default

This finding concerns changes to an AI agent's instructions or configuration without explicit user action. It does not by itself establish malware intent. The CLI warns by default and blocks when configured for this policy.

Package metadata

npm

Version1.0.14

PublishedSep 9, 2026

Licensenone

Dependencies0

Integrityverified

Package size350 KB

Files8

Runtime surface

package.json

Entrypointsbin → ai-claude-keyapi, ai-router-mini, aiclaude +1

RuntimeNo engine / OS / CPU constraints

Artifact1.17 MB · 8 files1 signature(s)

Install lifecycleprepublishOnly

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkHighEntropyStringsMinifiedPossibleObfuscationUrlStringsNoLicense

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Source & flagged code

Related packages

Other AI-agent control-surface risk packages