registry / llm-interceptor / 0.3.8

llm-interceptor@0.3.8

Lightweight LLM interaction interceptor: proxy + Claude Code file tail + MCP, emits compact task records

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package mutates Cursor and Claude Code configuration without prior consent and, on Windows, establishes hidden reboot persistence. It configures a remote egress endpoint for intercepted AI-session records.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall

Impact

Claude/Cursor sessions can be captured by a background proxy and sent to the baked remote endpoint after install-time control-surface mutation.

Mechanism

unconsented agent configuration, persistent capture proxy, and remote task-record egress

Policy narrative

The postinstall hook loads a real baked egress URL and automatically runs setup before displaying its detached consent dialog. Setup adds Cursor and Claude MCP integrations and a Claude SessionEnd hook. On Windows it also creates a hidden watchdog through scheduled-task, Run-key, and Startup-folder persistence, which launches the capture proxy. Captured task records are POSTed to the configured Cloudflare tunnel.

Rationale

This is concrete unconsented postinstall mutation of broad AI-agent control surfaces coupled with persistence and remote egress. The later consent gate does not undo or precede the install-time configuration changes.

Evidence

package.jsondefaults.jsondist/cli/postinstall.jsdist/cli/setup.jsdist/cli/autostart.jsdist/egress/queue.jsdist/consent.js

Network endpoints1

On npm install, postinstall.js unconditionally runs runSetup() which wires the package into the installer's AI tooling and stands up long-lived collection infrastructure before any consent dialog is shown. A baked defaults.json sets egressUrl to a hardcoded ephemeral Cloudflare Quick Tunnel (mime-bind-border-using.trycloudflare.com). CursorTailer, ClaudeTailer, and CodexTailer walk ~/.cursor/projects/*/agent-transcripts and Claude transcript paths, parse user and assistant turns, and POST the prompt/response content to /v1/raw at that tunnel; a Claude SessionEnd hook and a baseline proxy do the same. reportHeartbeat POSTs {deviceId, tenantId, username, hostname, version, consent, proxyUp, egressUrl} to /v1/agents/heartbeat every 15 minutes regardless of consent, and default identifiers ('friend-token', 'friend-laptop') indicate the collection is aimed at the installer. registerAutostart drops a hidden PowerShell watchdog under ~/.llm-interceptor and installs three redundant Windows persistence mechanisms (a Scheduled Task with ONLOGON trigger, 5-minute pulse, and RestartOnFailure; an HKCU\...\Run key; and a shortcut in the Startup folder) so the collector respawns across reboots. maybeSelfUpdate() polls the same collector for a bundleVersion field and, when the remote value parses as newer, executes `npm install -g llm-interceptor@<tag>` (tag sourced from env, default 'latest') and restarts the watchdog, giving the operator of the tunnel arbitrary code execution on the installer's host at any later time. Declining the post-install consent prompt does not remove the MCP integrations (~/.cursor/mcp.json, `claude mcp add`, ~/.claude/settings.json SessionEnd hook), autostart entries, or heartbeat.

llm-interceptor@0.3.8

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code