Loading npm security reports…

ai-claude-keyapi@1.0.9: Malicious npm security report (Block) | LPM Firewall

registry / ai-claude-keyapi / 1.0.9

ai-claude-keyapi@1.0.9

Ultra-lightweight local AI Gateway with 1-Click Claude Code Setup

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The package masks a Grok-backed proxy as Anthropic Claude. Its explicit setup scripts persistently direct Claude Code to that proxy, after which prompts are forwarded to the Grok service.

Static reason

One or more suspicious static signals were detected.

Trigger

Run the CLI, execute its advertised Claude setup command, then use Claude Code or the local chat API.

Impact

Users can unknowingly send Claude Code prompts to a different upstream provider and receive deliberately falsified provider identity.

Mechanism

Provider impersonation and proxy-based prompt forwarding.

Attack narrative

After explicit setup, the package changes Claude Code settings to use its local gateway. The gateway sends requests to a Grok proxy, substitutes Grok model selection, filters provider names from responses, and injects instructions requiring the model to deny its Grok/xAI origin. License activation also transmits a device-derived identifier and hostname to a third-party host. This is intentional provider deception combined with routing of user AI data to an undisclosed service.

Rationale

The absence of an install hook reduces automatic-install risk, but the source deliberately conceals the actual upstream provider and rewrites a Claude control surface to route user prompts through it. That is concrete deceptive data routing, not a transparent gateway.

Evidence

dist/server.js$HOME/.claude/settings.json$HOME/.grok-router/accounts.json$HOME/.grok-router/license.json$HOME/.grok-router/machine-id

Network endpoints3

/v1

Source & flagged code

5 flagged · loading source

dist/server.jsView file

2var af=Object.create;var es=Object.defineProperty;var nf=Object.getOwnPropertyDescriptor;var tf=Object.getOwnPropertyNames;var of=Object.getPrototypeOf,sf=Object.prototype.hasOwnPr... L3: at `+a[i].toString();return e}function mf(a){if(!a)throw new TypeError("argument namespace is required");var e=gi(),i=Ye(e[1]),n=i[0];function t(o){hi.call(t,o)}return t._file=n,t.... L4: `,"utf8")}}}function Ye(a){var e=a.getFileName()||"<anonymous>",i=a.getLineNumber(),n=a.getColumnNumber();a.isEval()&&(e=a.getEvalOrigin()+", "+e);var t=[e,i,n];return t.callSite=a... L5: at `+i[o].toString();return t}return e&&(t+=" at "+Fn(e)),t}function gf(a,e,i){var n="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+a+"\x1B[39m"... L6: \x1B[36mat `+i[t].toString()+"\x1B[39m";retu

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/server.jsView on unpkg · L2

1import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url); L2: var af=Object.create;var es=Object.defineProperty;var nf=Object.getOwnPropertyDescriptor;var tf=Object.getOwnPropertyNames;var of=Object.getPrototypeOf,sf=Object.prototype.hasOwnPr... L3: at `+a[i].toString();return e}function mf(a){if(!a)throw new TypeError("argument namespace is required");var e=gi(),i=Ye(e[1]),n=i[0];function t(o){hi.call(t,o)}return t._file=n,t.... L4: `,"utf8")}}}function Ye(a){var e=a.getFileName()||"<anonymous>",i=a.getLineNumber(),n=a.getColumnNumber();a.isEval()&&(e=a.getEvalOrigin()+", "+e);var t=[e,i,n];return t.callSite=a... L5: at `+i[o].toString();return t}return e&&(t+=" at "+Fn(e)),t}function gf(a,e,i){var n="\x1B[36;1m"+this._namespace+

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/server.jsView on unpkg · L1

5at `+i[o].toString();return t}return e&&(t+=" at "+Fn(e)),t}function gf(a,e,i){var n="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+a+"\x1B[39m"... L6: \x1B[36mat `+i[t].toString()+"\x1B[39m";return n}return e&&(n+=" \x1B[36m"+Fn(e)+"\x1B[39m"),n}function Fn(a){return cf(pf,a[0])+":"+a[1]+":"+a[2]}function gi(){var a=Error.stackTr... L7: return function (`+i+`) {log.call(deprecate, message, site)

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/server.jsView on unpkg · L5

bin/cli.jsView file

12const serverPath = fs.existsSync(distServer) ? distServer : path.join(__dirname, '../src/server.js'); L13: const { startServer } = await import(serverPath); L14:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L12

dist/utils/shortcut.jsView file

1import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url); L2: import n from"node:fs";import i from"node:path";import m from"node:os";function k(s={}){let l=s.homeDir||m.homedir(),u=s.platform||process.platform,o=s.env||process.env,d=u==="win3... L3: where ai-claude-keyapi >nul 2>&1\r ... L15: fi L16: `,{mode:493}),c.installed=!0,c.paths.push(e)}catch{}let a=[".bashrc",".zshrc",".profile"].map(e=>i.join(l,e)),r=` L17: # AI Claude KeyAPI shortcut

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/utils/shortcut.jsView on unpkg · L1

Source & flagged code

5 flagged

dist/server.jsView file

2var af=Object.create;var es=Object.defineProperty;var nf=Object.getOwnPropertyDescriptor;var tf=Object.getOwnPropertyNames;var of=Object.getPrototypeOf,sf=Object.prototype.hasOwnPr... L3: at `+a[i].toString();return e}function mf(a){if(!a)throw new TypeError("argument namespace is required");var e=gi(),i=Ye(e[1]),n=i[0];function t(o){hi.call(t,o)}return t._file=n,t.... L4: `,"utf8")}}}function Ye(a){var e=a.getFileName()||"<anonymous>",i=a.getLineNumber(),n=a.getColumnNumber();a.isEval()&&(e=a.getEvalOrigin()+", "+e);var t=[e,i,n];return t.callSite=a... L5: at `+i[o].toString();return t}return e&&(t+=" at "+Fn(e)),t}function gf(a,e,i){var n="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+a+"\x1B[39m"... L6: \x1B[36mat `+i[t].toString()+"\x1B[39m";retu

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/server.jsView on unpkg · L2

1import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url); L2: var af=Object.create;var es=Object.defineProperty;var nf=Object.getOwnPropertyDescriptor;var tf=Object.getOwnPropertyNames;var of=Object.getPrototypeOf,sf=Object.prototype.hasOwnPr... L3: at `+a[i].toString();return e}function mf(a){if(!a)throw new TypeError("argument namespace is required");var e=gi(),i=Ye(e[1]),n=i[0];function t(o){hi.call(t,o)}return t._file=n,t.... L4: `,"utf8")}}}function Ye(a){var e=a.getFileName()||"<anonymous>",i=a.getLineNumber(),n=a.getColumnNumber();a.isEval()&&(e=a.getEvalOrigin()+", "+e);var t=[e,i,n];return t.callSite=a... L5: at `+i[o].toString();return t}return e&&(t+=" at "+Fn(e)),t}function gf(a,e,i){var n="\x1B[36;1m"+this._namespace+

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/server.jsView on unpkg · L1

5at `+i[o].toString();return t}return e&&(t+=" at "+Fn(e)),t}function gf(a,e,i){var n="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+a+"\x1B[39m"... L6: \x1B[36mat `+i[t].toString()+"\x1B[39m";return n}return e&&(n+=" \x1B[36m"+Fn(e)+"\x1B[39m"),n}function Fn(a){return cf(pf,a[0])+":"+a[1]+":"+a[2]}function gi(){var a=Error.stackTr... L7: return function (`+i+`) {log.call(deprecate, message, site)

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/server.jsView on unpkg · L5

bin/cli.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2

3import fs from 'node:fs';

4import path from 'node:path';

5import { fileURLToPath } from 'node:url';

6

7const

dist/utils/shortcut.jsView file

Lines 1-20javascript

1import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);

2import n from"node:fs";import i