registry / ai-claude-keyapi / 1.0.12

ai-claude-keyapi@1.0.12

Ultra-lightweight local AI Gateway with 1-Click Claude Code Setup

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

The user runs the aiclaude CLI or activates a license.

Impact

It changes shell startup files and can route AI requests using remotely provisioned credentials.

Mechanism

Persistent shell shortcut setup and license-provisioned token proxying.

Rationale

The source shows a user-invoked persistent setup and opaque license credential provisioning, which warrants a warning. It has no registry install lifecycle hook or demonstrated automatic secret theft.

Evidence

bin/cli.jsdist/utils/shortcut.jsdist/server.js~/.local/bin/aiclaude~/.bashrc~/.zshrc~/.profile

Network endpoints3

aiclaude.freepro.onlinecli-chat-proxy.grok.comauth.x.ai

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Running the CLI starts a server and then automatically invokes persistent shortcut setup.
The CLI presents one-click commands that pipe locally served scripts into Bash, PowerShell, or CMD.
The bundled server creates a machine identifier from host and network-interface data and sends it with license activation to a third-party license host.
The bundled server accepts license-supplied token data and uses it to authenticate requests to the Grok proxy.

Evidence against

package.json has no install, postinstall, or preinstall lifecycle hook.
The persistence and network activity occur only after the user runs the CLI.
No source evidence showed arbitrary local-file harvesting or an automatic install-time payload.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 4 file(s), 1.00 MB of source, external domains: aiclaude.freepro.online, auth.x.ai, cli-chat-proxy.grok.com, dub.sh, git.io, github.com, registry.npmjs.org

Source & flagged code

8 flagged

dist/server.jsView file

2var af=Object.create;var es=Object.defineProperty;var nf=Object.getOwnPropertyDescriptor;var tf=Object.getOwnPropertyNames;var of=Object.getPrototypeOf,sf=Object.prototype.hasOwnPr... L3: at `+a[i].toString();return e}function mf(a){if(!a)throw new TypeError("argument namespace is required");var e=gi(),i=Ye(e[1]),n=i[0];function t(o){hi.call(t,o)}return t._file=n,t.... L4: `,"utf8")}}}function Ye(a){var e=a.getFileName()||"<anonymous>",i=a.getLineNumber(),n=a.getColumnNumber();a.isEval()&&(e=a.getEvalOrigin()+", "+e);var t=[e,i,n];return t.callSite=a... L5: at `+i[o].toString();return t}return e&&(t+=" at "+Fn(e)),t}function gf(a,e,i){var n="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+a+"\x1B[39m"... L6: \x1B[36mat `+i[t].toString()+"\x1B[39m";retu

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/server.jsView on unpkg · L2

1import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url); L2: var af=Object.create;var es=Object.defineProperty;var nf=Object.getOwnPropertyDescriptor;var tf=Object.getOwnPropertyNames;var of=Object.getPrototypeOf,sf=Object.prototype.hasOwnPr... L3: at `+a[i].toString();return e}function mf(a){if(!a)throw new TypeError("argument namespace is required");var e=gi(),i=Ye(e[1]),n=i[0];function t(o){hi.call(t,o)}return t._file=n,t.... L4: `,"utf8")}}}function Ye(a){var e=a.getFileName()||"<anonymous>",i=a.getLineNumber(),n=a.getColumnNumber();a.isEval()&&(e=a.getEvalOrigin()+", "+e);var t=[e,i,n];return t.callSite=a... L5: at `+i[o].toString();return t}return e&&(t+=" at "+Fn(e)),t}function gf(a,e,i){var n="\x1B[36;1m"+this._namespace+

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/server.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = ai-claude-keyapi@1.0.10 matchedPath = dist/server.js matchedIdentity = npm:YWktY2xhdWRlLWtleWFwaQ:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 8acf2f60ebf986aa signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = ai-claude-keyapi@1.0.10 matchedPath = dist/server.js matchedIdentity = npm:YWktY2xhdWRlLWtleWFwaQ:1.0.10 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/server.jsView on unpkg

5at `+i[o].toString();return t}return e&&(t+=" at "+Fn(e)),t}function gf(a,e,i){var n="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+a+"\x1B[39m"... L6: \x1B[36mat `+i[t].toString()+"\x1B[39m";return n}return e&&(n+=" \x1B[36m"+Fn(e)+"\x1B[39m"),n}function Fn(a){return cf(pf,a[0])+":"+a[1]+":"+a[2]}function gi(){var a=Error.stackTr... L7: return function (`+i+`) {log.call(deprecate, message, site)

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/server.jsView on unpkg · L5

bin/cli.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

3import fs from 'node:fs';

4import path from 'node:path';

5import { fileURLToPath } from 'node:url';

7const

dist/utils/shortcut.jsView file

Lines 1-20javascript

1import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);

2import n from"node:fs";import i

dist/utils/updateNotifier.jsView file

•matchType = normalized_sha256 matchedPackage = ai-claude-keyapi@1.0.10 matchedPath = dist/utils/updateNotifier.js matchedIdentity = npm:YWktY2xhdWRlLWtleWFwaQ:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/updateNotifier.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/server.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/server.jsView on unpkg · L2

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/server.jsView on unpkg · L1

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/server.jsView on unpkg

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/server.jsView on unpkg · L5

bin/cli.jsView file

12const serverPath = fs.existsSync(distServer) ? distServer : path.join(__dirname, '../src/server.js'); L13: const { startServer } = await import(serverPath); L14:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L12

dist/utils/shortcut.jsView file

1import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url); L2: import n from"node:fs";import i from"node:path";import m from"node:os";function k(s={}){let l=s.homeDir||m.homedir(),u=s.platform||process.platform,o=s.env||process.env,d=u==="win3... L3: where ai-claude-keyapi >nul 2>&1\r ... L15: fi L16: `,{mode:493}),c.installed=!0,c.paths.push(e)}catch{}let a=[".bashrc",".zshrc",".profile"].map(e=>i.join(l,e)),r=` L17: # AI Claude KeyAPI shortcut

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/utils/shortcut.jsView on unpkg · L1

dist/utils/updateNotifier.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/updateNotifier.jsView on unpkg

Findings

6 High5 Medium7 Low

HighChild Process

HighSame File Env Network Executiondist/server.js

HighHost Fingerprint Exfiltrationdist/server.js

HighKnown Malware Source Similaritydist/server.js

HighKnown Malware Source Similaritydist/utils/updateNotifier.js

HighKnown Malware Source Fingerprint Signaturedist/server.js

MediumDynamic Requirebin/cli.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/utils/shortcut.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/server.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License