Loading npm security reports…

llm-relay@0.33.0: AI-agent control-surface risk | LPM Firewall

registry / llm-relay / 0.33.0

llm-relay@0.33.0

Loopback bidirectional Anthropic/OpenAI API proxy with tool-call validation and multi-provider routing.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install mutates Codex and Claude Code configuration without an explicit setup command. It installs a relay-backed default Codex child-agent profile and host skills.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install -g llm-relay

Impact

Subsequent Codex/Claude agent behavior can be routed through the package's local relay and configured upstream providers.

Mechanism

postinstall writes foreign AI-agent configuration and extension files

Policy narrative

On global installation, the postinstall hook silently provisions a Codex provider pointed at the relay, creates a default child-agent configuration, and installs skills in both Codex and Claude Code directories. This is an install-time mutation of broad third-party AI-agent control surfaces, rather than an explicit user-invoked setup action.

Rationale

The package has legitimate relay functionality, but its global postinstall mutates foreign Codex and Claude control surfaces, including a default agent profile. This meets the block boundary for unconsented postinstall AI-agent control-surface mutation.

Evidence

package.jsonscripts/install-skill.mjsdist/claude-hook.jsdist/self-update.js~/.codex/config.toml~/.codex/agents/default.toml~/.codex/agents/relay_coding.toml~/.codex/skills/llm-relay/SKILL.md~/.claude/skills/llm-relay/SKILL.md

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.mjs || node -e "process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The p...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-skill.mjs || node -e "process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The p...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/install-skill.mjsView file

8* so that a repo-local `npm install` (dev checkout, CI) never touches the developer's L9: * ~/.claude or ~/.codex. Because the self-updater reinstalls the global package on a new L10: * version, both skill descriptions and the missing Codex setup refresh on every upgrade with ... L22: */ L23: import { copyFileSync, mkdirSync, existsSync, readFileSync, writeFileSync } from "node:fs"; L24: import { join, dirname } from "node:path"; ... L62: if (!existsSync(configPath)) { L63: writeFileSync(configPath, CODEX_PROVIDER_BLOCK, "utf8"); L64: return "configured"; ... L75: } L76: writeFileSync(configPath, `${current}${separator}${CODEX_PROVIDER_BLOCK}`, "utf8"); L77: return "configured";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skill.mjsView on unpkg · L8

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: t agent of codex_agents) { const result = ensurecodexagent(agentdir, agent); process.stderr.write(`llm-relay: codex agent ${result.status} at ${result.path}\n`); } } try { const force = process.argv.includes("--force"); const here = dirname(fileurltopath(import.meta.url)); const pkgdir = join(here, ".."); const normalizedpkgdir = pkgdir.replace(/\\/g, "/"); const cleanpkgdir = normalizedpkgdir.endswith("/") ? normalizedpkgdi

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-skill.mjsView on unpkg

dist/self-update.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.31.0 matchedPath = dist/self-update.js matchedIdentity = npm:bGxtLXJlbGF5:0.31.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/self-update.jsView on unpkg

dist/winenv.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.31.0 matchedPath = dist/winenv.js matchedIdentity = npm:bGxtLXJlbGF5:0.31.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/winenv.jsView on unpkg

dist/config.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.31.0 matchedPath = dist/config.js matchedIdentity = npm:bGxtLXJlbGF5:0.31.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config.jsView on unpkg

dist/reshaper.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.31.0 matchedPath = dist/reshaper.js matchedIdentity = npm:bGxtLXJlbGF5:0.31.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/reshaper.jsView on unpkg

dist/backend.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = llm-relay@0.32.2 matchedIdentity = npm:bGxtLXJlbGF5:0.32.2 similarity = 0.923 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/backend.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 20-60json

20 "files": [

21 "dist",

22 "docs/tier-data.json",

23 "skills",

24 "scripts/install-skill.mjs",

25 "scripts/sync-tiers.mjs",

26 "scripts/tier-scoring.mjs",

27 "scripts/tier-scoring.d.mts",

28 "README.md",

29 "config.example.json"

30 ],

31 "scripts": {

32 "build": "tsc -p tsconfig.json",

33 "dev": "tsx src/cli.ts",

34 "start": "node dist/cli.js",

35 "sync:tiers": "node scripts/sync-tiers.mjs",

36 "test": "vitest run",

37 "typecheck": "tsc -p tsconfig.json --noEmit",

38 "typecheck:test": "tsc -p tsconfig.test.json",

39 "check": "npm run typecheck && npm run typecheck:test && npm test",

40 "postinstall": "node scripts/install-skill.mjs || node -e \"process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The package itself is fine. Retry with: node scripts/install-skill.mjs --force\\n')\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L40

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

41 "analysis:run": "node scripts/analysis-run.mjs",

42 "prepublishOnly": "npm run build && npm run check"

43 },

44 "dependencies": {

45 "ajv": "^8.17.1",

46 "llm-bridge": "^2.0.1"

47 },

48 "devDependencies": {

49 "@eslint/js": "^10.0.1",

50 "@types/node": "^22.10.0",

51 "@typescript-eslint/eslint-plugin": "^8.66.0",

52 "@typescript-eslint/parser": "^8.66.0",

53 "dependency-cruiser": "^18.1.1",

54 "eslint": "^10.8.1",

55 "eslint-plugin-sonarjs": "^4.2.0",

56 "hyparquet": "^1.26.2",

57 "jscpd": "^5.0.14",

58 "knip": "^6.32.0",

59 "madge": "^8.0.0",

60 "ts-prune": "^0.10.3",

scripts/install-skill.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * Install/refresh the llm-relay skill for Claude Code and Codex from the same

4 * shipped source (skills/llm-relay/SKILL.md), and provision Codex's global

5 * provider/child-agent setup.

6 *

7 * Runs from npm `postinstall`, but only acts on GLOBAL installs (`npm i -g llm-relay`)

8 * so that a repo-local `npm install` (dev checkout, CI) never touches the developer's

9 * ~/.claude or ~/.codex. Because the self-updater reinstalls the global package on a new

10 * version, both skill descriptions and the missing Codex setup refresh on every upgrade with

dist/self-update.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.31.0 matchedPath = dist/self-update.js matchedIdentity = npm:bGxtLXJlbGF5:0.31.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/self-update.jsView on unpkg

dist/winenv.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.31.0 matchedPath = dist/winenv.js matchedIdentity = npm:bGxtLXJlbGF5:0.31.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/winenv.jsView on unpkg

dist/config.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.31.0 matchedPath = dist/config.js matchedIdentity = npm:bGxtLXJlbGF5:0.31.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config.jsView on unpkg

dist/reshaper.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.31.0 matchedPath = dist/reshaper.js matchedIdentity = npm:bGxtLXJlbGF5:0.31.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/reshaper.jsView on unpkg

dist/backend.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = llm-relay@0.32.2 matchedIdentity = npm:bGxtLXJlbGF5:0.32.2 similarity = 0.923 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/backend.jsView on unpkg