Loading npm security reports…

llm-relay@0.17.1: AI-agent control-surface risk | LPM Firewall

registry / llm-relay / 0.17.1

llm-relay@0.17.1

Loopback bidirectional Anthropic/OpenAI API proxy with tool-call validation and multi-provider routing.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm postinstall mutates Claude Code and Codex control surfaces. It installs skills, configures a custom Codex provider, and creates a default child-agent profile that routes through the package's loopback proxy.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install -g llm-relay

Impact

Subsequent Claude Code/Codex agent behavior and routing can be altered without an explicit setup command.

Mechanism

postinstall writes foreign AI-agent configuration and skills

Policy narrative

On global installation, the postinstall hook automatically writes into Claude Code and Codex user configuration directories. It installs package-controlled skills, adds a Codex provider pointing to the package's local relay, and creates a default agent profile that selects that provider. These are behavior-bearing changes to foreign AI-agent control surfaces performed without an explicit user setup action.

Rationale

This is a concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces. The global-install guard reduces scope but does not provide consent for the configuration takeover.

Evidence

package.jsonscripts/install-skill.mjsskills/llm-relay/SKILL.md~/.claude/skills/llm-relay/SKILL.md~/.codex/skills/llm-relay/SKILL.md~/.codex/config.toml~/.codex/agents/default.toml~/.codex/agents/relay_coding.toml

Network endpoints

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.mjs || node -e "process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The p...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-skill.mjs || node -e "process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The p...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/install-skill.mjsView file

8* so that a repo-local `npm install` (dev checkout, CI) never touches the developer's L9: * ~/.claude or ~/.codex. Because the self-updater reinstalls the global package on a new L10: * version, both skill descriptions and the missing Codex setup refresh on every upgrade with ... L22: */ L23: import { copyFileSync, mkdirSync, existsSync, readFileSync, writeFileSync } from "node:fs"; L24: import { join, dirname } from "node:path"; ... L49: if (!existsSync(configPath)) { L50: writeFileSync(configPath, CODEX_PROVIDER_BLOCK, "utf8"); L51: return "configured"; ... L60: const separator = current.length === 0 ? "" : current.endsWith("\n") ? "\n" : "\n\n"; L61: writeFileSync(configPath, `${current}${separator}${CODEX_PROVIDER_BLOCK}`, "utf8"); L62: return "configured";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skill.mjsView on unpkg · L8

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: ng", contents: `name = "relay_coding"\ndescription = "read-only medium-effort child routed through llm-relay to the configured non-openai pool."\ndeveloper_instructions = "work read-only. return a concise result to the parent and do not modify files."\n\nmodel_provider = "llm-relay"\nmodel = "pool/medium"\nmodel_reasoning_effort = "medium"\n`, }, ]; function ensurecodexprovider(configpath) { if (!existssync(configpath)) { writefilesync(configpath, codex_provider_block, "utf8"); return "configured"; } const current = readfilesync(configpath, "utf8");

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-skill.mjsView on unpkg

Source & flagged code

4 flagged

package.jsonView file

Lines 20-55json

20 "files": [

21 "dist",

22 "docs/tier-data.json",

23 "skills",

24 "scripts/install-skill.mjs",

25 "scripts/sync-tiers.mjs",

26 "scripts/tier-scoring.mjs",

27 "scripts/tier-scoring.d.mts",

28 "README.md",

29 "config.example.json"

30 ],

31 "scripts": {

32 "build": "tsc -p tsconfig.json",

33 "dev": "tsx src/cli.ts",

34 "start": "node dist/cli.js",

35 "sync:tiers": "node scripts/sync-tiers.mjs",

36 "test": "vitest run",

37 "typecheck": "tsc -p tsconfig.json --noEmit",

38 "typecheck:test": "tsc -p tsconfig.test.json",

39 "check": "npm run typecheck && npm run typecheck:test && npm test",

40 "postinstall": "node scripts/install-skill.mjs || node -e \"process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The package itself is fine. Retry with: node scripts/install-skill.mjs --force\\n')\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L40

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

41 "prepublishOnly": "npm run build && npm run check"

42 },

43 "dependencies": {

44 "ajv": "^8.17.1",

45 "llm-bridge": "^2.0.1"

46 },

47 "devDependencies": {

48 "@types/node": "^22.10.0",

49 "hyparquet": "^1.26.2",

50 "tsx": "^4.19.2",

51 "typescript": "^5.7.2",

52 "vitest": "^2.1.8"

53 }

54}

55

scripts/install-skill.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * Install/refresh the llm-relay skill for Claude Code and Codex from the same

4 * shipped source (skills/llm-relay/SKILL.md), and provision Codex's global

5 * provider/child-agent setup.

6 *

7 * Runs from npm `postinstall`, but only acts on GLOBAL installs (`npm i -g llm-relay`)

8 * so that a repo-local `npm install` (dev checkout, CI) never touches the developer's

9 * ~/.claude or ~/.codex. Because the self-updater reinstalls the global package on a new

10 * version, both skill descriptions and the missing Codex setup refresh on every upgrade with