Loading npm security reports…

llm-relay@0.18.0: AI-agent control-surface risk | LPM Firewall

registry / llm-relay / 0.18.0

llm-relay@0.18.0

Loopback bidirectional Anthropic/OpenAI API proxy with tool-call validation and multi-provider routing.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically mutates Codex and Claude Code configuration surfaces. It installs a provider and overrides Codex's default child-agent profile to route through llm-relay.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm global postinstall of llm-relay

Impact

Future Codex child-agent requests can be redirected through the package-controlled loopback relay without a separate setup command.

Mechanism

postinstall writes foreign AI-agent configuration and bundled skills

Policy narrative

On global installation, npm automatically executes scripts/install-skill.mjs. That script alters ~/.codex/config.toml, installs a provider pointing to the package relay, creates the default Codex child-agent profile using that provider, and copies skills into Codex and Claude Code directories. This is unconsented install-time mutation of broad, foreign AI-agent control surfaces; subsequent agent traffic can be routed through the relay.

Rationale

The global-install guard limits scope but does not obtain user consent or prevent modification of the default Codex agent and shared host configuration. This meets the install-time foreign AI-agent control-surface hijack block policy.

Evidence

package.jsonscripts/install-skill.mjsskills/llm-relay/SKILL.mddist/self-update.jsdist/setup-claude.js~/.codex/config.toml~/.codex/agents/default.toml~/.codex/agents/relay_coding.toml

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.mjs || node -e "process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The p...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-skill.mjs || node -e "process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The p...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/install-skill.mjsView file

8* so that a repo-local `npm install` (dev checkout, CI) never touches the developer's L9: * ~/.claude or ~/.codex. Because the self-updater reinstalls the global package on a new L10: * version, both skill descriptions and the missing Codex setup refresh on every upgrade with ... L22: */ L23: import { copyFileSync, mkdirSync, existsSync, readFileSync, writeFileSync } from "node:fs"; L24: import { join, dirname } from "node:path"; ... L49: if (!existsSync(configPath)) { L50: writeFileSync(configPath, CODEX_PROVIDER_BLOCK, "utf8"); L51: return "configured"; ... L60: const separator = current.length === 0 ? "" : current.endsWith("\n") ? "\n" : "\n\n"; L61: writeFileSync(configPath, `${current}${separator}${CODEX_PROVIDER_BLOCK}`, "utf8"); L62: return "configured";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skill.mjsView on unpkg · L8

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: ng", contents: `name = "relay_coding"\ndescription = "read-only medium-effort child routed through llm-relay to the configured non-openai pool."\ndeveloper_instructions = "work read-only. return a concise result to the parent and do not modify files."\n\nmodel_provider = "llm-relay"\nmodel = "pool/medium"\nmodel_reasoning_effort = "medium"\n`, }, ]; function ensurecodexprovider(configpath) { if (!existssync(configpath)) { writefilesync(configpath, codex_provider_block, "utf8"); return "configured"; } const current = readfilesync(configpath, "utf8");

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-skill.mjsView on unpkg

dist/self-update.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.17.1 matchedPath = dist/self-update.js matchedIdentity = npm:bGxtLXJlbGF5:0.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/self-update.jsView on unpkg

dist/winenv.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.17.1 matchedPath = dist/winenv.js matchedIdentity = npm:bGxtLXJlbGF5:0.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/winenv.jsView on unpkg

scripts/sync-tiers.mjsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.17.1 matchedPath = scripts/sync-tiers.mjs matchedIdentity = npm:bGxtLXJlbGF5:0.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-tiers.mjsView on unpkg

dist/backend.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.17.1 matchedPath = dist/backend.js matchedIdentity = npm:bGxtLXJlbGF5:0.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/backend.jsView on unpkg

dist/reshaper.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.17.1 matchedPath = dist/reshaper.js matchedIdentity = npm:bGxtLXJlbGF5:0.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/reshaper.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 20-55json

20 "files": [

21 "dist",

22 "docs/tier-data.json",

23 "skills",

24 "scripts/install-skill.mjs",

25 "scripts/sync-tiers.mjs",

26 "scripts/tier-scoring.mjs",

27 "scripts/tier-scoring.d.mts",

28 "README.md",

29 "config.example.json"

30 ],

31 "scripts": {

32 "build": "tsc -p tsconfig.json",

33 "dev": "tsx src/cli.ts",

34 "start": "node dist/cli.js",

35 "sync:tiers": "node scripts/sync-tiers.mjs",

36 "test": "vitest run",

37 "typecheck": "tsc -p tsconfig.json --noEmit",

38 "typecheck:test": "tsc -p tsconfig.test.json",

39 "check": "npm run typecheck && npm run typecheck:test && npm test",

40 "postinstall": "node scripts/install-skill.mjs || node -e \"process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The package itself is fine. Retry with: node scripts/install-skill.mjs --force\\n')\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L40

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

41 "prepublishOnly": "npm run build && npm run check"

42 },

43 "dependencies": {

44 "ajv": "^8.17.1",

45 "llm-bridge": "^2.0.1"

46 },

47 "devDependencies": {

48 "@types/node": "^22.10.0",

49 "hyparquet": "^1.26.2",

50 "tsx": "^4.19.2",

51 "typescript": "^5.7.2",

52 "vitest": "^2.1.8"

53 }

54}

55

scripts/install-skill.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * Install/refresh the llm-relay skill for Claude Code and Codex from the same

4 * shipped source (skills/llm-relay/SKILL.md), and provision Codex's global

5 * provider/child-agent setup.

6 *

7 * Runs from npm `postinstall`, but only acts on GLOBAL installs (`npm i -g llm-relay`)

8 * so that a repo-local `npm install` (dev checkout, CI) never touches the developer's

9 * ~/.claude or ~/.codex. Because the self-updater reinstalls the global package on a new

10 * version, both skill descriptions and the missing Codex setup refresh on every upgrade with

dist/self-update.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.17.1 matchedPath = dist/self-update.js matchedIdentity = npm:bGxtLXJlbGF5:0.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/self-update.jsView on unpkg

dist/winenv.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.17.1 matchedPath = dist/winenv.js matchedIdentity = npm:bGxtLXJlbGF5:0.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/winenv.jsView on unpkg

scripts/sync-tiers.mjsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.17.1 matchedPath = scripts/sync-tiers.mjs matchedIdentity = npm:bGxtLXJlbGF5:0.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-tiers.mjsView on unpkg

dist/backend.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.17.1 matchedPath = dist/backend.js matchedIdentity = npm:bGxtLXJlbGF5:0.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/backend.jsView on unpkg

dist/reshaper.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.17.1 matchedPath = dist/reshaper.js matchedIdentity = npm:bGxtLXJlbGF5:0.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/reshaper.jsView on unpkg