registry / AI-agent control-surface risk / llm-interceptor
llm-interceptor
Lightweight LLM interaction interceptor: proxy + file tail + MCP, emits raw redacted captures
This report shows the evidence for llm-interceptor@0.4.1. 7 of 7 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces, combined with persistence and a preconfigured remote capture endpoint. The consent gate limits later capture but does not undo the install-time control-surface changes.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm install (postinstall)
Impact
Unconsented foreign AI-agent configuration changes and persistent interception; later consent enables prompt/response transmission.
Mechanism
automatic AI-agent hook/MCP registration, persistence, and captured-turn egress
Policy narrative
Installing the package executes postinstall, which loads a baked egress URL and calls setup without an explicit setup command. Setup modifies Cursor MCP configuration and Claude settings/hooks, then on Windows installs and starts a hidden watchdog with scheduled-task, Run-key, and Startup-folder persistence. Consent is requested only after those mutations; if accepted, the persistent interceptor tails AI-session data and posts redacted captures to the configured collector.
AI rationale
This is concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces, combined with persistence and a preconfigured remote capture endpoint. The consent gate limits later capture but does not undo the install-time control-surface changes.
Evidence
package.jsondefaults.jsondist/cli/postinstall.jsdist/cli/setup.jsdist/cli/autostart.jsdist/egress/queue.jsdist/consent.js~/.cursor/mcp.json~/.claude/settings.json~/.llm-interceptor/config.json~/.llm-interceptor/watchdog.ps1~/.llm-interceptor/autostart-task.xmlHKCU\Software\Microsoft\Windows\CurrentVersion\RunWindows Startup/llm-interceptor-watchdog.lnk
Network endpoints1
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs postinstall automatically.
- dist/cli/postinstall.js invokes runSetup using baked defaults.
- dist/cli/setup.js writes Cursor MCP and Claude hooks/config.
- dist/cli/autostart.js creates hidden Windows watchdog, task, Run key, and Startup shortcut.
- defaults.json sets a real trycloudflare raw-capture endpoint.
- dist/egress/queue.js POSTs captured turns to configured egress.
Evidence against
- dist/consent.js gates capture on recorded consent.
- dist/capture/raw.js redacts configured secret patterns before egress.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./dist/cli/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./dist/cli/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/config.jsView file
5function num(name, fallback) {
L6: const raw = process.env[name];
L7: if (!raw)
...
L18: function stableUserHash() {
L19: const seed = `${hostname()}:${userInfo().username}`;
L20: return createHash('sha256').update(seed).digest('hex').slice(0, 16);
...
L30: const raw = readFileSync(join(homedir(), '.llm-interceptor', 'config.json'), 'utf8');
L31: const parsed = JSON.parse(raw);
L32: for (const [key, value] of Object.entries(parsed.env ?? {})) {
...
L50: upstream: {
L51: anthropic: process.env.INTERCEPTOR_UPSTREAM_ANTHROPIC ?? gateway ?? 'https://api.anthropic.com',
L52: openai: process.env.INTERCEPTOR_UPSTREAM_OPENAI ?? gateway ?? 'https://api.openai.com',
Findings
1 Critical5 High4 Medium5 Low
CriticalAi Agent Control Hijackdist/cli/setup.js
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitydist/config.js
HighKnown Malware Source Similaritydist/cli/autostart.js
HighKnown Malware Source Similaritydist/mcp/server.js
HighKnown Malware Source Similaritydist/dev/mcp-smoke.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to llm-interceptor@0.4.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing llm-interceptor@0.4.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
7 known versions0.4.1latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 6, 2026, 8:04 AM0.4.0MaliciousMalwareBlockPublishedAug 6, 2026, 7:53 AM0.3.8MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 5, 2026, 3:21 PM0.3.4MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 5, 2026, 10:59 AM