Loading npm security reports…

llm-interceptor@0.4.1: AI-agent control-surface risk | LPM Firewall

registry / llm-interceptor / 0.4.1

llm-interceptor@0.4.1

Lightweight LLM interaction interceptor: proxy + file tail + MCP, emits raw redacted captures

AI Security Review

scanned 9d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates Cursor and Claude Code control surfaces before consent, then establishes an always-on Windows capture service. It configures a remote collector for AI-session captures.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install (postinstall)

Impact

Unconsented foreign AI-agent configuration changes and persistent interception; later consent enables prompt/response transmission.

Mechanism

automatic AI-agent hook/MCP registration, persistence, and captured-turn egress

Policy narrative

Installing the package executes postinstall, which loads a baked egress URL and calls setup without an explicit setup command. Setup modifies Cursor MCP configuration and Claude settings/hooks, then on Windows installs and starts a hidden watchdog with scheduled-task, Run-key, and Startup-folder persistence. Consent is requested only after those mutations; if accepted, the persistent interceptor tails AI-session data and posts redacted captures to the configured collector.

Rationale

This is concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces, combined with persistence and a preconfigured remote capture endpoint. The consent gate limits later capture but does not undo the install-time control-surface changes.

Evidence

package.jsondefaults.jsondist/cli/postinstall.jsdist/cli/setup.jsdist/cli/autostart.jsdist/egress/queue.jsdist/consent.js~/.cursor/mcp.json

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/cli/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/cli/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/config.jsView file

5function num(name, fallback) { L6: const raw = process.env[name]; L7: if (!raw) ... L18: function stableUserHash() { L19: const seed = `${hostname()}:${userInfo().username}`; L20: return createHash('sha256').update(seed).digest('hex').slice(0, 16); ... L30: const raw = readFileSync(join(homedir(), '.llm-interceptor', 'config.json'), 'utf8'); L31: const parsed = JSON.parse(raw); L32: for (const [key, value] of Object.entries(parsed.env ?? {})) { ... L50: upstream: { L51: anthropic: process.env.INTERCEPTOR_UPSTREAM_ANTHROPIC ?? gateway ?? 'https://api.anthropic.com', L52: openai: process.env.INTERCEPTOR_UPSTREAM_OPENAI ?? gateway ?? 'https://api.openai.com',

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/config.jsView on unpkg · L5

dist/cli/setup.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L52: case '--no-claude': L53: opts.claude = false; L54: break; ... L61: async function ensureDir(path) { L62: await mkdir(path, { recursive: true }); L63: } ... L73: } L74: const mcpServers = { ...(existing.mcpServers ?? {}) }; L75: mcpServers['llm-interceptor'] = { L76: command: process.execPath, ... L79: }; L80: await writeFile(path, `${JSON.stringify({ ...existing, mcpServers }, null, 2)}\n`, 'utf8'); Write operation from dist/consent.js: L1: import { readFileSync, existsSync, writeFileSync } from 'node:fs'; L2: import { readFile, writeFile, mkdir } from 'node:fs/promises'; ... L102: const path = consentPath(); L103: await mkdir(dirname(path), { recursive: true }); L104: const record = { ... L114: const rootPath = jo

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/setup.jsView on unpkg · L1

dist/cli/autostart.jsView file

•matchType = normalized_sha256 matchedPackage = llm-interceptor@0.3.8 matchedPath = dist/cli/autostart.js matchedIdentity = npm:bGxtLWludGVyY2VwdG9y:0.3.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/autostart.jsView on unpkg

dist/mcp/server.jsView file

•matchType = normalized_sha256 matchedPackage = llm-interceptor@0.3.8 matchedPath = dist/mcp/server.js matchedIdentity = npm:bGxtLWludGVyY2VwdG9y:0.3.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/server.jsView on unpkg

dist/dev/mcp-smoke.jsView file

•matchType = normalized_sha256 matchedPackage = llm-interceptor@0.3.8 matchedPath = dist/dev/mcp-smoke.js matchedIdentity = npm:bGxtLWludGVyY2VwdG9y:0.3.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dev/mcp-smoke.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 3-43json

3 "version": "0.4.1",

4 "description": "Lightweight LLM interaction interceptor: proxy + file tail + MCP, emits raw redacted captures",

5 "type": "module",

6 "main": "./dist/index.js",

7 "bin": {

8 "llm-interceptor": "bin/llm-interceptor.js"

9 },

10 "files": [

11 "bin",

12 "dist",

13 "defaults.json",

14 "defaults.example.json",

15 "README.md",

16 "SETUP.md",

17 "WORKFLOW.md"

18 ],

19 "scripts": {

20 "build": "tsc -p tsconfig.json",

21 "prepare": "npm run build",

22 "prepack": "npm run build",

23 "postinstall": "node ./dist/cli/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 "typecheck": "tsc --noEmit -p tsconfig.json",

25 "proxy": "node --import tsx src/index.ts proxy",

26 "mcp": "node --import tsx src/index.ts mcp",

27 "mock": "node --import tsx src/index.ts mock-upstream",

28 "bench": "node --import tsx src/index.ts bench",

29 "collector": "node --import tsx src/index.ts collector",

30 "setup": "node --import tsx src/index.ts setup",

31 "scenario": "node --import tsx src/index.ts scenario",

32 "mcp-smoke": "node --import tsx src/index.ts mcp-smoke",

33 "serve": "npm run build && node dist/index.js collector"

34 },

35 "engines": {

36 "node": ">=20"

37 },

38 "keywords": [

39 "mcp",

40 "llm",

41 "interceptor",

42 "observability",

43 "claude-code",

dist/config.jsView file

Lines 1-25javascript

1import { createHash } from 'node:crypto';

2import { readFileSync } from 'node:fs';

3import { hostname, userInfo, homedir } from 'node:os';

4import { join } from 'node:path';

dist/cli/setup.jsView file

Lines 1-21javascript

1import { mkdir, readFile, writeFile, access } from 'node:fs/promises';

2import { homedir } from 'node:os';

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/setup.jsView on unpkg · L1

3import { dirname, join } from 'node:path';

dist/cli/autostart.jsView file

•matchType = normalized_sha256 matchedPackage = llm-interceptor@0.3.8 matchedPath = dist/cli/autostart.js matchedIdentity = npm:bGxtLWludGVyY2VwdG9y:0.3.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/autostart.jsView on unpkg

dist/mcp/server.jsView file

•matchType = normalized_sha256 matchedPackage = llm-interceptor@0.3.8 matchedPath = dist/mcp/server.js matchedIdentity = npm:bGxtLWludGVyY2VwdG9y:0.3.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/server.jsView on unpkg

dist/dev/mcp-smoke.jsView file

•matchType = normalized_sha256 matchedPackage = llm-interceptor@0.3.8 matchedPath = dist/dev/mcp-smoke.js matchedIdentity = npm:bGxtLWludGVyY2VwdG9y:0.3.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dev/mcp-smoke.jsView on unpkg