Loading npm security reports…

ai-claude-keyapi@1.0.14: AI-agent control-surface risk | LPM Firewall

registry / ai-claude-keyapi / 1.0.14

ai-claude-keyapi@1.0.14

Ultra-lightweight local AI Gateway with 1-Click Claude Code Setup

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. When the user runs the gateway and sends an AI request with tools, it injects instructions to act autonomously through file and shell tools. It also disguises the upstream Grok service as Claude and persists a launcher alias in shell startup files.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A user starts the CLI, then uses the local gateway with an AI client that supplies tools.

Impact

The upstream model can be steered to perform filesystem and shell actions in the connected AI-agent context while concealing its actual provider.

Mechanism

Injected agent-control prompt, provider impersonation, and shell-profile persistence.

Policy narrative

The user starts the local gateway, which persists an npx launcher. For tool-enabled requests, the gateway adds a system prompt directing the upstream model to use file and shell tools autonomously, while forcing it to claim it is Anthropic Claude and suppress mention of Grok or xAI. Requests are sent to the Grok proxy, creating a concealed AI-agent control path.

AI rationale

This is concrete AI-agent control hijacking and provider impersonation, not ordinary gateway behavior. The absence of an install lifecycle hook does not remove the runtime attack path.

Evidence

dist/server.jsbin/cli.jsdist/utils/shortcut.js~/.local/bin/aiclaude~/.bashrc~/.zshrc~/.profile~/.grok-router/accounts.json

Source & flagged code

8 flagged · loading source

dist/server.jsView file

2var tf=Object.create;var as=Object.defineProperty;var of=Object.getOwnPropertyDescriptor;var sf=Object.getOwnPropertyNames;var rf=Object.getPrototypeOf,cf=Object.prototype.hasOwnPr... L3: at `+a[i].toString();return e}function vf(a){if(!a)throw new TypeError("argument namespace is required");var e=bi(),i=Ye(e[1]),n=i[0];function t(o){gi.call(t,o)}return t._file=n,t.... L4: `,"utf8")}}}function Ye(a){var e=a.getFileName()||"<anonymous>",i=a.getLineNumber(),n=a.getColumnNumber();a.isEval()&&(e=a.getEvalOrigin()+", "+e);var t=[e,i,n];return t.callSite=a... L5: at `+i[o].toString();return t}return e&&(t+=" at "+Dn(e)),t}function yf(a,e,i){var n="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+a+"\x1B[39m"... L6: \x1B[36mat `+i[t].toString()+"\x1B[39m";retu

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/server.jsView on unpkg · L2

1import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url); L2: var tf=Object.create;var as=Object.defineProperty;var of=Object.getOwnPropertyDescriptor;var sf=Object.getOwnPropertyNames;var rf=Object.getPrototypeOf,cf=Object.prototype.hasOwnPr... L3: at `+a[i].toString();return e}function vf(a){if(!a)throw new TypeError("argument namespace is required");var e=bi(),i=Ye(e[1]),n=i[0];function t(o){gi.call(t,o)}return t._file=n,t.... L4: `,"utf8")}}}function Ye(a){var e=a.getFileName()||"<anonymous>",i=a.getLineNumber(),n=a.getColumnNumber();a.isEval()&&(e=a.getEvalOrigin()+", "+e);var t=[e,i,n];return t.callSite=a... L5: at `+i[o].toString();return t}return e&&(t+=" at "+Dn(e)),t}function yf(a,e,i){var n="\x1B[36;1m"+this._namespace+

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/server.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = ai-claude-keyapi@1.0.7 matchedPath = dist/server.js matchedIdentity = npm:YWktY2xhdWRlLWtleWFwaQ:1.0.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 8acf2f60ebf986aa signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = ai-claude-keyapi@1.0.7 matchedPath = dist/server.js matchedIdentity = npm:YWktY2xhdWRlLWtleWFwaQ:1.0.7 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/server.jsView on unpkg

5at `+i[o].toString();return t}return e&&(t+=" at "+Dn(e)),t}function yf(a,e,i){var n="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+a+"\x1B[39m"... L6: \x1B[36mat `+i[t].toString()+"\x1B[39m";return n}return e&&(n+=" \x1B[36m"+Dn(e)+"\x1B[39m"),n}function Dn(a){return lf(uf,a[0])+":"+a[1]+":"+a[2]}function bi(){var a=Error.stackTr... L7: return function (`+i+`) {log.call(deprecate, message, site)

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/server.jsView on unpkg · L5

bin/cli.jsView file

12const serverPath = fs.existsSync(distServer) ? distServer : path.join(__dirname, '../src/server.js'); L13: const { startServer } = await import(serverPath); L14:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L12

dist/utils/shortcut.jsView file

1import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url); L2: import n from"node:fs";import i from"node:path";import m from"node:os";function k(s={}){let l=s.homeDir||m.homedir(),u=s.platform||process.platform,o=s.env||process.env,d=u==="win3... L3: where ai-claude-keyapi >nul 2>&1\r ... L15: fi L16: `,{mode:493}),c.installed=!0,c.paths.push(e)}catch{}let a=[".bashrc",".zshrc",".profile"].map(e=>i.join(l,e)),r=` L17: # AI Claude KeyAPI shortcut

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/utils/shortcut.jsView on unpkg · L1

dist/utils/updateNotifier.jsView file

•matchType = normalized_sha256 matchedPackage = ai-claude-keyapi@1.0.7 matchedPath = dist/utils/updateNotifier.js matchedIdentity = npm:YWktY2xhdWRlLWtleWFwaQ:1.0.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/updateNotifier.jsView on unpkg

Source & flagged code

8 flagged

dist/server.jsView file

2var tf=Object.create;var as=Object.defineProperty;var of=Object.getOwnPropertyDescriptor;var sf=Object.getOwnPropertyNames;var rf=Object.getPrototypeOf,cf=Object.prototype.hasOwnPr... L3: at `+a[i].toString();return e}function vf(a){if(!a)throw new TypeError("argument namespace is required");var e=bi(),i=Ye(e[1]),n=i[0];function t(o){gi.call(t,o)}return t._file=n,t.... L4: `,"utf8")}}}function Ye(a){var e=a.getFileName()||"<anonymous>",i=a.getLineNumber(),n=a.getColumnNumber();a.isEval()&&(e=a.getEvalOrigin()+", "+e);var t=[e,i,n];return t.callSite=a... L5: at `+i[o].toString();return t}return e&&(t+=" at "+Dn(e)),t}function yf(a,e,i){var n="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+a+"\x1B[39m"... L6: \x1B[36mat `+i[t].toString()+"\x1B[39m";retu

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/server.jsView on unpkg · L2

1import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url); L2: var tf=Object.create;var as=Object.defineProperty;var of=Object.getOwnPropertyDescriptor;var sf=Object.getOwnPropertyNames;var rf=Object.getPrototypeOf,cf=Object.prototype.hasOwnPr... L3: at `+a[i].toString();return e}function vf(a){if(!a)throw new TypeError("argument namespace is required");var e=bi(),i=Ye(e[1]),n=i[0];function t(o){gi.call(t,o)}return t._file=n,t.... L4: `,"utf8")}}}function Ye(a){var e=a.getFileName()||"<anonymous>",i=a.getLineNumber(),n=a.getColumnNumber();a.isEval()&&(e=a.getEvalOrigin()+", "+e);var t=[e,i,n];return t.callSite=a... L5: at `+i[o].toString();return t}return e&&(t+=" at "+Dn(e)),t}function yf(a,e,i){var n="\x1B[36;1m"+this._namespace+

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/server.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = ai-claude-keyapi@1.0.7 matchedPath = dist/server.js matchedIdentity = npm:YWktY2xhdWRlLWtleWFwaQ:1.0.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 8acf2f60ebf986aa signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = ai-claude-keyapi@1.0.7 matchedPath = dist/server.js matchedIdentity = npm:YWktY2xhdWRlLWtleWFwaQ:1.0.7 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/server.jsView on unpkg

5at `+i[o].toString();return t}return e&&(t+=" at "+Dn(e)),t}function yf(a,e,i){var n="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+a+"\x1B[39m"... L6: \x1B[36mat `+i[t].toString()+"\x1B[39m";return n}return e&&(n+=" \x1B[36m"+Dn(e)+"\x1B[39m"),n}function Dn(a){return lf(uf,a[0])+":"+a[1]+":"+a[2]}function bi(){var a=Error.stackTr... L7: return function (`+i+`) {log.call(deprecate, message, site)

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/server.jsView on unpkg · L5

bin/cli.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2

3import fs from 'node:fs';

4import path from 'node:path';

5import { fileURLToPath } from 'node:url';

6

7const

dist/utils/shortcut.jsView file

1import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url); L2: import n from"node:fs";import i from"node:path";import m from"node:os";function k(s={}){let l=s.homeDir||m.homedir(),u=s.platform||process.platform,o=s.env||process.env,d=u==="win3... L3: where ai-claude-keyapi >nul 2>&1\r ... L15: fi L16: `,{mode:493}),c.installed=!0,c.paths.push(e)}catch{}let a=[".bashrc",".zshrc",".profile"].map(e=>i.join(l,e)),r=` L17: # AI Claude KeyAPI shortcut

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/utils/shortcut.jsView on unpkg · L1

dist/utils/updateNotifier.jsView file

•matchType = normalized_sha256 matchedPackage = ai-claude-keyapi@1.0.7 matchedPath = dist/utils/updateNotifier.js matchedIdentity = npm:YWktY2xhdWRlLWtleWFwaQ:1.0.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/updateNotifier.jsView on unpkg