llm-failover-proxy@1.9.1
OpenAI-compatible LLM proxy with automatic provider failover, streaming support, and a terminal UI to manage providers, models and priority order.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a real install-time persistence capability, so warning is appropriate. The source supports a package-aligned local proxy rather than concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm install; global installs select the enable path
Impact
A background process starts without an explicit runtime command and may persist across login for global installs.
Mechanism
install-time daemon launch and user-session autostart registration
AI rationale
This is a real install-time persistence capability, so warning is appropriate. The source supports a package-aligned local proxy rather than concrete malicious behavior.
Evidence
package.jsonscripts/postinstall.jsscripts/preuninstall.jsdist/index.js
Network endpoints1
registry.npmjs.org/-/package/llm-failover-proxy/dist-tags
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- postinstall unconditionally invokes daemon/enable unless opt-out or CI.
- Global installs invoke enable, which writes and activates user login persistence.
- The daemon is detached and runs the package entrypoint in the background.
Evidence against
- Persistence is explicitly package-named and removed by preuninstall.
- No source evidence of credential harvesting or exfiltration to an attacker-controlled endpoint.
- Observed registry request is an opt-out-able npm update check.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
14 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
4var GR=Object.create;var qd=Object.defineProperty;var LR=Object.getOwnPropertyDescriptor;var OR=Object.getOwnPropertyNames;var HR=Object.getPrototypeOf,FR=Object.prototype.hasOwnPr...
L5: `).replace(/\\r/g,"\r").replace(/\\t/g," ").replace(/\\(["'\\])/g,"$1");if(t.length>=2&&t.startsWith("'")&&t.endsWith("'"))return t.slice(1,-1);let n=t.indexOf(" #");return(n===-1?...
L6: `).trimEnd()}
L7: `,{mode:384}),ta.renameSync(g,e);try{ta.chmodSync(e,384)}catch{}if(n)for(let[d,E]of i)process.env[d]=String(E),Pd.add(d),jd[d]=String(E);return{file:e,written:u}}var JR,$C,Pd,jd,Sr...
L8: `),$C=/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/,Pd=new Set,jd={}});import VR from"node:crypto";import li from"node:fs";import XR from"node:os";import Wn from"node:path"...
L9: `,{mode:384}),li.renameSyn
Findings
2 Critical11 High5 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighEntrypoint Foreign Package Code Overwritedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighCross File Remote Execution Contextscripts/postinstall.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighTrigger Reachable Persistence
Affected versions and remediation
This report applies to llm-failover-proxy@1.9.1.
See all versions of llm-failover-proxy for other recorded verdicts.
- Review the evidence and your use of llm-failover-proxy@1.9.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.