llm-failover-proxy@1.11.0
OpenAI-compatible LLM proxy with automatic provider failover, streaming support, and a terminal UI to manage providers, models and priority order.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe automatic daemon and global login registration are real lifecycle risks, but no concrete exfiltration, payload staging, or self-dependency chain was found. Downgrade to a warning rather than block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
npm postinstall during a non-CI, non-npx installation.
Impact
A background Node process starts without an explicit command, and global installs can persist across login.
Mechanism
Automatic lifecycle launch and global login persistence.
AI rationale
The automatic daemon and global login registration are real lifecycle risks, but no concrete exfiltration, payload staging, or self-dependency chain was found. Downgrade to a warning rather than block.
Evidence
package.jsonscripts/postinstall.jsdist/index.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The postinstall hook automatically starts a background process for every non-CI installation.
- For global installs, that automatic hook invokes the command that registers a login-start entry.
- The lifecycle hook runs the packaged CLI through child_process without an interactive user command.
Evidence against
- The hook skips npx and source-checkout installs, and supports a CI or environment-variable opt-out.
- The manifest has no runtime dependencies or self-dependency chain.
- Inspection found no secret harvesting or exfiltration endpoint; provider traffic is part of the proxy function.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
8`),Ah=/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/,jd=new Set,Wd={}});import eb from"node:crypto";import li from"node:fs";import tb from"node:os";import Wn from"node:path"...
L9: `,{mode:384}),li.renameSync(o,t);try{li.chmodSync(t,384)}catch{}return e.__file=t,t}function ah(e){let t=nh.warp,n=(m,Q)=>{let h=Math.trunc(Number(m));return Number.isFinite(h)&&h>...
L10: `)),t}catch{return ia}}function yh(e){try{let{origin:t}=JSON.parse(nt.readFileSync(hh(e),"utf8"));return typeof t=="string"&&!nt.existsSync(t)}catch{return!1}}function sE(e){try{re...
Findings
9 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighCross File Remote Execution Contextscripts/postinstall.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighTrigger Reachable Persistencedist/index.js
HighKnown Malware Source Similarityscripts/postinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
Affected versions and remediation
This report applies to llm-failover-proxy@1.11.0.
See all versions of llm-failover-proxy for other recorded verdicts.
- Review the evidence and your use of llm-failover-proxy@1.11.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.