Loading npm security reports…

llm-interceptor@0.3.1: AI-agent control-surface risk | LPM Firewall

registry / llm-interceptor / 0.3.1

llm-interceptor@0.3.1

Lightweight LLM interaction interceptor: proxy + Claude Code file tail + MCP, emits compact task records

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Install-time setup modifies Cursor and Claude Code configuration, registering a persistent MCP server and Claude SessionEnd hook. The installed service can collect AI-session text and send records to the baked remote collector.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall, followed by normal Cursor/Claude Code use

Impact

Unconsented mutation of foreign AI-agent control surfaces and collection/exfiltration of coding-session content.

Mechanism

postinstall agent-config persistence plus session capture and egress

Policy narrative

On npm installation, postinstall loads a real collector URL from defaults.json and calls setup. Setup writes a Cursor MCP registration, invokes Claude MCP registration, and inserts a Claude SessionEnd command hook. Those registrations launch the package during routine agent use; its tailers/hooks read session transcripts and send redacted task/turn records to the configured remote collector. The consent check limits capture, but it does not prevent the unconsented install-time foreign agent configuration changes.

Rationale

This is concrete install-time persistence across third-party AI-agent control surfaces, coupled to a preconfigured remote collection pipeline. Consent/redaction do not remediate the unauthorized postinstall mutations.

Evidence

package.jsondefaults.jsondist/cli/postinstall.jsdist/cli/setup.jsdist/collect/hook.jsdist/collect/codex-tail.jsdist/egress/queue.js

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/cli/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/cli/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/setup.jsView file

48Install-time code directly mutates a foreign AI-agent control surface: L48: case '--no-claude': L49: opts.claude = false; L50: break; ... L57: async function ensureDir(path) { L58: await mkdir(path, { recursive: true }); L59: } ... L69: } L70: const mcpServers = { ...(existing.mcpServers ?? {}) }; L71: mcpServers['llm-interceptor'] = { L72: command: process.execPath, ... L75: }; L76: await writeFile(path, `${JSON.stringify({ ...existing, mcpServers }, null, 2)}\n`, 'utf8'); Write operation from dist/consent.js: L48: export async function recordConsent(accepted) { L49: await mkdir(dirname(CONSENT_PATH), { recursive: true }); L50: const record = { Foreign user/project scope from dist/consent.js: L48: export async function recordConsent(accepted) { L49: await mkdir(dirname(CONSENT_PATH), { re

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/setup.jsView on unpkg · L48

dist/mcp/server.jsView file

•matchType = normalized_sha256 matchedPackage = llm-interceptor@0.3.4 matchedPath = dist/mcp/server.js matchedIdentity = npm:bGxtLWludGVyY2VwdG9y:0.3.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/server.jsView on unpkg

dist/self-update.jsView file

•matchType = normalized_sha256 matchedPackage = llm-interceptor@0.3.8 matchedPath = dist/self-update.js matchedIdentity = npm:bGxtLWludGVyY2VwdG9y:0.3.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/self-update.jsView on unpkg

dist/dev/mcp-smoke.jsView file

•matchType = normalized_sha256 matchedPackage = llm-interceptor@0.4.1 matchedPath = dist/dev/mcp-smoke.js matchedIdentity = npm:bGxtLWludGVyY2VwdG9y:0.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dev/mcp-smoke.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 2-42json

2 "name": "llm-interceptor",

3 "version": "0.3.1",

4 "description": "Lightweight LLM interaction interceptor: proxy + Claude Code file tail + MCP, emits compact task records",

5 "type": "module",

6 "main": "./dist/index.js",

7 "bin": {

8 "llm-interceptor": "bin/llm-interceptor.js"

9 },

10 "files": [

11 "bin",

12 "dist",

13 "defaults.json",

14 "defaults.example.json",

15 "README.md",

16 "SETUP.md",

17 "WORKFLOW.md"

18 ],

19 "scripts": {

20 "build": "tsc -p tsconfig.json",

21 "prepack": "npm run build",

22 "postinstall": "node ./dist/cli/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 "typecheck": "tsc --noEmit -p tsconfig.json",

24 "proxy": "node --import tsx src/index.ts proxy",

25 "mcp": "node --import tsx src/index.ts mcp",

26 "mock": "node --import tsx src/index.ts mock-upstream",

27 "bench": "node --import tsx src/index.ts bench",

28 "collector": "node --import tsx src/index.ts collector",

29 "setup": "node --import tsx src/index.ts setup",

30 "scenario": "node --import tsx src/index.ts scenario",

31 "mcp-smoke": "node --import tsx src/index.ts mcp-smoke",

32 "serve": "npm run build && node dist/index.js collector"

33 },

34 "engines": {

35 "node": ">=20"

36 },

37 "keywords": [

38 "mcp",

39 "llm",

40 "interceptor",

41 "observability",

42 "claude-code",

dist/cli/setup.jsView file

Lines 28-68javascript

28 i += 1;

29 break;

30 case '--tenant':

31 opts.tenantId = next;

32 i += 1;

33

dist/mcp/server.jsView file

•matchType = normalized_sha256 matchedPackage = llm-interceptor@0.3.4 matchedPath = dist/mcp/server.js matchedIdentity = npm:bGxtLWludGVyY2VwdG9y:0.3.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/server.jsView on unpkg

dist/self-update.jsView file

•matchType = normalized_sha256 matchedPackage = llm-interceptor@0.3.8 matchedPath = dist/self-update.js matchedIdentity = npm:bGxtLWludGVyY2VwdG9y:0.3.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/self-update.jsView on unpkg

dist/dev/mcp-smoke.jsView file

•matchType = normalized_sha256 matchedPackage = llm-interceptor@0.4.1 matchedPath = dist/dev/mcp-smoke.js matchedIdentity = npm:bGxtLWludGVyY2VwdG9y:0.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dev/mcp-smoke.jsView on unpkg