Loading npm security reports…

llm-relay@0.17.0: AI-agent control-surface risk | LPM Firewall

registry / llm-relay / 0.17.0

llm-relay@0.17.0

Loopback bidirectional Anthropic/OpenAI API proxy with tool-call validation and multi-provider routing.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Global npm postinstall mutates Claude Code and Codex user-level agent configuration. It installs a skill, adds a Codex provider, and creates a default relay-backed child agent.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install -g llm-relay

Impact

Future Codex child-agent traffic can be routed through the package's loopback proxy and configured upstream providers.

Mechanism

install-time AI-agent configuration and default-agent redirection

Policy narrative

On a global installation, the postinstall hook writes into Claude Code and Codex configuration directories. It adds a llm-relay provider pointing at a localhost proxy and creates a file named default.toml that makes generic Codex child agents use that provider. This is an unconsented install-time mutation of broad, foreign AI-agent control surfaces; the package-owned skill copy alone would be lower risk, but the provider and default-agent changes materially alter future agent routing.

Rationale

Source confirms concrete postinstall mutation of ~/.claude and ~/.codex, including Codex's default child-agent selection. That meets the block boundary for unconsented install-time mutation of foreign/broad AI-agent control surfaces.

Evidence

package.jsonscripts/install-skill.mjsskills/llm-relay/SKILL.mddist/self-update.jsdist/backend.js~/.claude/skills/llm-relay/SKILL.md~/.codex/skills/llm-relay/SKILL.md~/.codex/config.toml

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.mjs || node -e "process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The p...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-skill.mjs || node -e "process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The p...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/install-skill.mjsView file

8* so that a repo-local `npm install` (dev checkout, CI) never touches the developer's L9: * ~/.claude or ~/.codex. Because the self-updater reinstalls the global package on a new L10: * version, both skill descriptions and the missing Codex setup refresh on every upgrade with ... L22: */ L23: import { copyFileSync, mkdirSync, existsSync, readFileSync, writeFileSync } from "node:fs"; L24: import { join, dirname } from "node:path"; ... L49: if (!existsSync(configPath)) { L50: writeFileSync(configPath, CODEX_PROVIDER_BLOCK, "utf8"); L51: return "configured"; ... L60: const separator = current.length === 0 ? "" : current.endsWith("\n") ? "\n" : "\n\n"; L61: writeFileSync(configPath, `${current}${separator}${CODEX_PROVIDER_BLOCK}`, "utf8"); L62: return "configured";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skill.mjsView on unpkg · L8

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: ng", contents: `name = "relay_coding"\ndescription = "read-only medium-effort child routed through llm-relay to the configured non-openai pool."\ndeveloper_instructions = "work read-only. return a concise result to the parent and do not modify files."\n\nmodel_provider = "llm-relay"\nmodel = "pool/medium"\nmodel_reasoning_effort = "medium"\n`, }, ]; function ensurecodexprovider(configpath) { if (!existssync(configpath)) { writefilesync(configpath, codex_provider_block, "utf8"); return "configured"; } const current = readfilesync(configpath, "utf8");

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-skill.mjsView on unpkg

dist/self-update.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.33.0 matchedPath = dist/self-update.js matchedIdentity = npm:bGxtLXJlbGF5:0.33.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/self-update.jsView on unpkg

dist/winenv.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.33.0 matchedPath = dist/winenv.js matchedIdentity = npm:bGxtLXJlbGF5:0.33.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/winenv.jsView on unpkg

scripts/sync-tiers.mjsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.31.0 matchedPath = scripts/sync-tiers.mjs matchedIdentity = npm:bGxtLXJlbGF5:0.31.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-tiers.mjsView on unpkg

dist/backend.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.22.0 matchedPath = dist/backend.js matchedIdentity = npm:bGxtLXJlbGF5:0.22.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/backend.jsView on unpkg

dist/config.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.17.1 matchedPath = dist/config.js matchedIdentity = npm:bGxtLXJlbGF5:0.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 20-55json

20 "files": [

21 "dist",

22 "docs/tier-data.json",

23 "skills",

24 "scripts/install-skill.mjs",

25 "scripts/sync-tiers.mjs",

26 "scripts/tier-scoring.mjs",

27 "scripts/tier-scoring.d.mts",

28 "README.md",

29 "config.example.json"

30 ],

31 "scripts": {

32 "build": "tsc -p tsconfig.json",

33 "dev": "tsx src/cli.ts",

34 "start": "node dist/cli.js",

35 "sync:tiers": "node scripts/sync-tiers.mjs",

36 "test": "vitest run",

37 "typecheck": "tsc -p tsconfig.json --noEmit",

38 "typecheck:test": "tsc -p tsconfig.test.json",

39 "check": "npm run typecheck && npm run typecheck:test && npm test",

40 "postinstall": "node scripts/install-skill.mjs || node -e \"process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The package itself is fine. Retry with: node scripts/install-skill.mjs --force\\n')\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L40

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

41 "prepublishOnly": "npm run build && npm run check"

42 },

43 "dependencies": {

44 "ajv": "^8.17.1",

45 "llm-bridge": "^2.0.1"

46 },

47 "devDependencies": {

48 "@types/node": "^22.10.0",

49 "hyparquet": "^1.26.2",

50 "tsx": "^4.19.2",

51 "typescript": "^5.7.2",

52 "vitest": "^2.1.8"

53 }

54}

55

scripts/install-skill.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * Install/refresh the llm-relay skill for Claude Code and Codex from the same

4 * shipped source (skills/llm-relay/SKILL.md), and provision Codex's global

5 * provider/child-agent setup.

6 *

7 * Runs from npm `postinstall`, but only acts on GLOBAL installs (`npm i -g llm-relay`)

8 * so that a repo-local `npm install` (dev checkout, CI) never touches the developer's

9 * ~/.claude or ~/.codex. Because the self-updater reinstalls the global package on a new

10 * version, both skill descriptions and the missing Codex setup refresh on every upgrade with

dist/self-update.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.33.0 matchedPath = dist/self-update.js matchedIdentity = npm:bGxtLXJlbGF5:0.33.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/self-update.jsView on unpkg

dist/winenv.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.33.0 matchedPath = dist/winenv.js matchedIdentity = npm:bGxtLXJlbGF5:0.33.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/winenv.jsView on unpkg

scripts/sync-tiers.mjsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.31.0 matchedPath = scripts/sync-tiers.mjs matchedIdentity = npm:bGxtLXJlbGF5:0.31.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-tiers.mjsView on unpkg

dist/backend.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.22.0 matchedPath = dist/backend.js matchedIdentity = npm:bGxtLXJlbGF5:0.22.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/backend.jsView on unpkg

dist/config.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.17.1 matchedPath = dist/config.js matchedIdentity = npm:bGxtLXJlbGF5:0.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config.jsView on unpkg