registry / Persistence / llm-failover-proxy

llm-failover-proxy

OpenAI-compatible LLM proxy with automatic provider failover, streaming support, and a terminal UI to manage providers, models and priority order.

This report shows the evidence for llm-failover-proxy@1.3.0. 1 of 14 known versions is blocked or flagged. The newest version, 1.11.0, is flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package’s proxy behavior is plausible, but automatic daemon startup and login persistence during postinstall are concrete harmful behavior outside an explicit user action.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm postinstall, especially global installation

Impact

Persistent background process and provider-key-capable proxy run after installation.

Mechanism

daemon launch plus OS login persistence

Attack narrative

The install hook invokes the package CLI to launch a detached daemon for ordinary installs. On global install it invokes enable, which writes and activates a per-user launch-at-login artifact; the daemon copies the package entrypoint into its service directory and runs it in the background. This is unconsented persistence triggered solely by package installation.

AI rationale

The package’s proxy behavior is plausible, but automatic daemon startup and login persistence during postinstall are concrete harmful behavior outside an explicit user action.

Evidence

package.jsonscripts/postinstall.jsscripts/preuninstall.jsdist/index.js~/Library/LaunchAgents/com.llm-failover-proxy.plist$XDG_CONFIG_HOME/systemd/user/llm-failover-proxy.service

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs postinstall automatically.
scripts/postinstall.js starts daemon on install.
dist/index.js writes login persistence and activates it.
Global installs create LaunchAgent/systemd/Startup entry.

Evidence against

Proxy forwarding uses configured provider endpoints.
preuninstall.js attempts service cleanup.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 545 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.cerebras.ai, api.deepseek.com, api.example.com, api.fireworks.ai, api.groq.com, api.mistral.ai, api.openai.com, api.together.xyz, api.x.ai, generativelanguage.googleapis.com, github.com, integrate.api.nvidia.com, opencode.ai, openrouter.ai, react.dev, registry.npmjs.org, www.apple.com

Source & flagged code

11 flagged

package.jsonView file

Lines 40-71json

40 "llmfp": "dist/index.js"

41 },

42 "files": [

43 "dist",

44 "defaults",

45 "scripts/postinstall.js",

46 "scripts/preuninstall.js",

47 ".env.example",

48 "README.md",

49 "LICENSE"

50 ],

51 "scripts": {

52 "build": "node scripts/build.js",

53 "start": "node src/index.js start",

54 "ui": "node src/index.js",

55 "status": "node src/index.js status",

56 "env:example": "node scripts/gen-env-example.js",

57 "demo": "node examples/demo.js",

58 "test": "node --test",

59 "prepack": "node scripts/build.js",

60 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L60

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L60

61 "preuninstall": "node scripts/preuninstall.js"

62 },

63 "dependencies": {},

64 "devDependencies": {

65 "esbuild": "^0.28.1",

66 "ink": "^7.1.1",

67 "ink-testing-library": "^4.0.0",

68 "react": "^19.2.8"

69 }

70}

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = llm-failover-proxy@1.2.0 matchedIdentity = npm:bGxtLWZhaWxvdmVyLXByb3h5:1.2.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

8`),pm=/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/,Gf=new Set,kf={}});import hN from"node:crypto";import Yi from"node:fs";import QN from"node:os";import Gn from"node:path"... L9: `,{mode:384}),Yi.renameSync(a,t);try{Yi.chmodSync(t,384)}catch{}return e.__file=t,t}function ym(e){return{id:e.id||zi("prov"),name:String(e.name||"provider").trim(),type:e.type==="... L10: `)),t}catch{return Ur}}function Mm(e){try{let{origin:t}=JSON.parse(je.readFileSync(Rm(e),"utf8"));return typeof t=="string"&&!je.existsSync(t)}catch{return!1}}function Yf(e){try{re...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L8

4var sN=Object.create;var Uf=Object.defineProperty;var lN=Object.getOwnPropertyDescriptor;var uN=Object.getOwnPropertyNames;var cN=Object.getPrototypeOf,gN=Object.prototype.hasOwnPr... L5: `).replace(/\\r/g,"\r").replace(/\\t/g," ").replace(/\\(["'\\])/g,"$1");if(t.length>=2&&t.startsWith("'")&&t.endsWith("'"))return t.slice(1,-1);let i=t.indexOf(" #");return(i===-1?... L6: `).trimEnd()} ... L8: `),pm=/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/,Gf=new Set,kf={}});import hN from"node:crypto";import Yi from"node:fs";import QN from"node:os";import Gn from"node:path"... L9: `,{mode:384}),Yi.renameSync(a,t);try{Yi.chmodSync(t,384)}catch{}return e.__file=t,t}function ym(e){return{id:e.id||zi("prov"),name:String(e.name||"provider").trim(),type:e.type==="... L10: `)),t}catch{return Ur

scripts/postinstall.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2/**

3 * Runs after `npm install`. Puts the proxy in the background so it is ready to

4 * answer right away, and, for a global install, brings it back at every login.

5 *

6 * Deliberately conservative: it does nothing at all for `npx`, for CI, or when

7 * the repository's own dependencies are being installed. It also never fails the

8 * install, whatever happens.

9 */

10import { spawnSync }

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.js

Findings

1 Critical9 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/index.js

HighShell

HighSame File Env Network Executiondist/index.js

HighEntrypoint Foreign Package Code Overwritedist/index.js

HighCommand Output Exfiltrationdist/index.js

HighCross File Remote Execution Contextscripts/postinstall.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

HighTrigger Reachable Persistencedist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

Affected versions and remediation

This report applies to llm-failover-proxy@1.3.0.

The versions list below shows the verdict for each recorded version.

Avoid installing llm-failover-proxy@1.3.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-11 13:04:17.186Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

14 known versions

1.11.0latestSuspiciousInstall Hook AbuseWarnPublishedSep 8, 2026, 6:33 PM 1.10.0SuspiciousPersistenceWarnPublishedAug 26, 2026, 11:04 AM 1.9.1SuspiciousPersistenceWarnPublishedAug 25, 2026, 12:24 PM 1.9.0SuspiciousPersistenceWarnPublishedAug 22, 2026, 1:21 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other persistence packages

Behavioral surface

Related packages

Other persistence packages

Source & flagged code