llm-relay: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

llm-relay: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.mjs || node -e "process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The p...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-skill.mjs || node -e "process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The p...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/install-skill.mjsView file

8* so that a repo-local `npm install` (dev checkout, CI) never touches the developer's L9: * ~/.claude or ~/.codex. Because the self-updater reinstalls the global package on a new L10: * version, both skill descriptions and the missing Codex setup refresh on every upgrade with ... L22: */ L23: import { copyFileSync, mkdirSync, existsSync, readFileSync, writeFileSync } from "node:fs"; L24: import { join, dirname } from "node:path"; ... L62: if (!existsSync(configPath)) { L63: writeFileSync(configPath, CODEX_PROVIDER_BLOCK, "utf8"); L64: return "configured"; ... L75: } L76: writeFileSync(configPath, `${current}${separator}${CODEX_PROVIDER_BLOCK}`, "utf8"); L77: return "configured";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skill.mjsView on unpkg · L8

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: t agent of codex_agents) { const result = ensurecodexagent(agentdir, agent); process.stderr.write(`llm-relay: codex agent ${result.status} at ${result.path}\n`); } } try { const force = process.argv.includes("--force"); const here = dirname(fileurltopath(import.meta.url)); const pkgdir = join(here, ".."); const normalizedpkgdir = pkgdir.replace(/\\/g, "/"); const cleanpkgdir = normalizedpkgdir.endswith("/") ? normalizedpkgdi

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-skill.mjsView on unpkg

dist/self-update.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.33.0 matchedPath = dist/self-update.js matchedIdentity = npm:bGxtLXJlbGF5:0.33.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/self-update.jsView on unpkg

dist/refusal-interpretation.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.33.0 matchedPath = dist/refusal-interpretation.js matchedIdentity = npm:bGxtLXJlbGF5:0.33.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/refusal-interpretation.jsView on unpkg

dist/winenv.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.33.0 matchedPath = dist/winenv.js matchedIdentity = npm:bGxtLXJlbGF5:0.33.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/winenv.jsView on unpkg

scripts/sync-tiers.mjsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.33.0 matchedPath = scripts/sync-tiers.mjs matchedIdentity = npm:bGxtLXJlbGF5:0.33.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-tiers.mjsView on unpkg

dist/config.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.33.0 matchedPath = dist/config.js matchedIdentity = npm:bGxtLXJlbGF5:0.33.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 20-60json

20 "files": [

21 "dist",

22 "docs/tier-data.json",

23 "skills",

24 "scripts/install-skill.mjs",

25 "scripts/sync-tiers.mjs",

26 "scripts/tier-scoring.mjs",

27 "scripts/tier-scoring.d.mts",

28 "README.md",

29 "config.example.json"

30 ],

31 "scripts": {

32 "build": "tsc -p tsconfig.json",

33 "dev": "tsx src/cli.ts",

34 "start": "node dist/cli.js",

35 "sync:tiers": "node scripts/sync-tiers.mjs",

36 "test": "vitest run",

37 "typecheck": "tsc -p tsconfig.json --noEmit",

38 "typecheck:test": "tsc -p tsconfig.test.json",

39 "check": "npm run typecheck && npm run typecheck:test && npm test",

40 "postinstall": "node scripts/install-skill.mjs || node -e \"process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The package itself is fine. Retry with: node scripts/install-skill.mjs --force\\n')\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L40

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

41 "analysis:run": "node scripts/analysis-run.mjs",

42 "prepublishOnly": "npm run build && npm run check"

43 },

44 "dependencies": {

45 "ajv": "^8.17.1",

46 "llm-bridge": "^2.0.1"

47 },

48 "devDependencies": {

49 "@eslint/js": "^10.0.1",

50 "@types/node": "^22.10.0",

51 "@typescript-eslint/eslint-plugin": "^8.66.0",

52 "@typescript-eslint/parser": "^8.66.0",

53 "dependency-cruiser": "^18.1.1",

54 "eslint": "^10.8.1",

55 "eslint-plugin-sonarjs": "^4.2.0",

56 "hyparquet": "^1.26.2",

57 "jscpd": "^5.0.14",

58 "knip": "^6.32.0",

59 "madge": "^8.0.0",

60 "ts-prune": "^0.10.3",

scripts/install-skill.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * Install/refresh the llm-relay skill for Claude Code and Codex from the same

4 * shipped source (skills/llm-relay/SKILL.md), and provision Codex's global

5 * provider/child-agent setup.

6 *

7 * Runs from npm `postinstall`, but only acts on GLOBAL installs (`npm i -g llm-relay`)

8 * so that a repo-local `npm install` (dev checkout, CI) never touches the developer's

9 * ~/.claude or ~/.codex. Because the self-updater reinstalls the global package on a new

10 * version, both skill descriptions and the missing Codex setup refresh on every upgrade with

dist/self-update.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.33.0 matchedPath = dist/self-update.js matchedIdentity = npm:bGxtLXJlbGF5:0.33.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/self-update.jsView on unpkg

dist/refusal-interpretation.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.33.0 matchedPath = dist/refusal-interpretation.js matchedIdentity = npm:bGxtLXJlbGF5:0.33.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/refusal-interpretation.jsView on unpkg

dist/winenv.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.33.0 matchedPath = dist/winenv.js matchedIdentity = npm:bGxtLXJlbGF5:0.33.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/winenv.jsView on unpkg

scripts/sync-tiers.mjsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.33.0 matchedPath = scripts/sync-tiers.mjs matchedIdentity = npm:bGxtLXJlbGF5:0.33.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-tiers.mjsView on unpkg

dist/config.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.33.0 matchedPath = dist/config.js matchedIdentity = npm:bGxtLXJlbGF5:0.33.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config.jsView on unpkg