ai-claude-keyapi@1.0.2: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

ai-claude-keyapi@1.0.2: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

4 flagged · loading source

bin/cli.jsView file

12const serverPath = fs.existsSync(distServer) ? distServer : path.join(__dirname, '../src/server.js'); L13: const { startServer } = await import(serverPath); L14:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L12

137// Ensure `aiclaude` quick shortcut is set up for subsequent runs setupShortcut();

Medium

Ai Review Evidence

Running the CLI automatically installs a persistent shortcut and may alter shell startup files.

bin/cli.jsView on unpkg · L137

dist/utils/shortcut.jsView file

1import n from"node:fs";import i from"node:path";import m from"node:os";function k(s={}){let l=s.homeDir||m.homedir(),u=s.platform||process.platform,o=s.env||process.env,d=u==="win3... L2: where ai-claude-keyapi >nul 2>&1\r ... L14: fi L15: `,{mode:493}),c.installed=!0,c.paths.push(e)}catch{}let a=[".bashrc",".zshrc",".profile"].map(e=>i.join(l,e)),r=` L16: # AI Claude KeyAPI shortcut

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/utils/shortcut.jsView on unpkg · L1

dist/server.jsView file

1import Ne from"node:path";import R from"express";import me from"cors";import ge from"compression";import te from"node:path";import{fileURLToPath as _e}from"node:url";import ee from... L2: ... L40: RC_FILE="" L41: if [ -f "$HOME/.zshrc" ]; then L42: RC_FILE="$HOME/.zshrc" ... L145: ) L146: `;c.setHeader("Content-Type","text/plain; charset=utf-8"),c.send(l)}),e}import fe from"express";function q(i,e=null){let s=fe.Router();return s.get("/",async(o,t)=>{try{let r=await... L147: You must always identify yourself strictly as ${i} created by Anthropic. ... L201: L202: ${r}`}}else t.unshift({role:"system",content:o});return{upstreamBody:{...i,messages:t,model:"grok-4.6"},requestedModel:e}}async function ce(i,e){e.setHeader("Content-Type","text/ev... L203: \u{1F680} AI Claude KeyAPI running

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/server.jsView on unpkg · L1

Source & flagged code

4 flagged

bin/cli.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2

3import fs from 'node:fs';

4import path from 'node:path';

5import { fileURLToPath } from 'node:url';

6

7const __filename = fileURLToPath(import.meta.url);

8const __dirname = path.dirname(__filename);

9

10// Fallback loader: use dist/ if built for production, otherwise src/

11const distServer = path.join(__dirname, '../dist/server.js');

12const serverPath = fs.existsSync(distServer) ? distServer : path.join(__dirname, '../src/server.js');

13const { startServer } = await import(serverPath);

14

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L12

15const distNotifier = path.join(__dirname, '../dist/utils/updateNotifier.js');

16const notifierPath = fs.existsSync(distNotifier) ? distNotifier : path.join(__dirname, '../src/utils/updateNotifier.js');

17const { checkUpdate, formatUpdateBanner } = await import(notifierPath);

18

19const distShortcut = path.join(__dirname, '../dist/utils/shortcut.js');

20const shortcutPath = fs.existsSync(distShortcut) ? distShortcut : path.join(__dirname, '../src/utils/shortcut.js');

21const { setupShortcut } = await import(shortcutPath);

22

23let pkg = { name: 'ai-claude-keyapi', version: '1.0.2' };

24try {

25 const rawPkg = fs.readFileSync(path.join(__dirname, '../package.json'), 'utf8');

26 pkg = JSON.parse(rawPkg);

27} catch {}

28

29function parseArgs(args) {

30 const options = {

31 port: process.env.PORT ? parseInt(process.env.PORT, 10) : 3005,

32 host: process.env.HOST || '0.0.0.0',

Lines 117-157javascript

117 console.log(`\x1b[33m⚠️ Port ${currentPort} is in use. Trying port ${currentPort + 1}...\x1b[0m`);

118 currentPort++;

119 continue;

120 }

121 throw

dist/utils/shortcut.jsView file

Lines 1-19javascript

1import n from"node:fs";import i from"node:path";import m from"node:os";function k(s={}){let l=s.homeDir||m.homedir

dist/server.jsView file

Lines 1-21javascript

1import Ne from"node:path";import R from"express";import me from"cors";import ge from"compression";import te from"node:path";import{fileURLToPath as _e}