Loading npm security reports…

llm-relay@0.37.0: AI-agent control-surface risk | LPM Firewall

registry / llm-relay / 0.37.0

llm-relay@0.37.0

Loopback bidirectional Anthropic/OpenAI API proxy with tool-call validation and multi-provider routing.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On global npm installation, the package mutates Claude Code and Codex control surfaces. It changes Codex child-agent routing to its relay without an interactive opt-in.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install -g llm-relay

Impact

Generic Codex child-agent requests can be routed through the package's local relay and its configured providers.

Mechanism

postinstall writes host skills, Codex provider configuration, and agent definitions

Policy narrative

A global installation automatically runs install-skill.mjs. That script writes package-owned skills into Claude Code and Codex directories, appends an llm-relay provider to Codex configuration, and creates a default Codex child agent routed to the relay. This changes another agent product's behavior during package installation rather than through an explicit setup command.

Rationale

The package performs an unconsented postinstall mutation of foreign AI-agent configuration and defines a default agent routed through its relay. The global-install guard limits exposure but does not remove the control-surface hijack.

Evidence

package.jsonscripts/install-skill.mjsskills/llm-relay/SKILL.md~/.claude/skills/llm-relay/SKILL.md~/.codex/skills/llm-relay/SKILL.md~/.codex/config.toml~/.codex/agents/default.toml~/.codex/agents/relay_coding.toml

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.mjs || node -e "process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The p...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-skill.mjs || node -e "process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The p...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/self-update.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/self-update.js: import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, readdirSync, writeFileSync } from "node:fs"; const REGISTRY = "https://registry.npmjs.org"; writeFileSync(cacheFile(), JSON.stringify({ checkedAt: now, latest }), "utf8");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/self-update.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = llm-relay@0.17.0 matchedPath = dist/self-update.js matchedIdentity = npm:bGxtLXJlbGF5:0.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/self-update.jsView on unpkg

scripts/install-skill.mjsView file

8* so that a repo-local `npm install` (dev checkout, CI) never touches the developer's L9: * ~/.claude or ~/.codex. Because the self-updater reinstalls the global package on a new L10: * version, both skill descriptions and the missing Codex setup refresh on every upgrade with ... L22: */ L23: import { copyFileSync, mkdirSync, existsSync, readFileSync, writeFileSync } from "node:fs"; L24: import { join, dirname } from "node:path"; ... L62: if (!existsSync(configPath)) { L63: writeFileSync(configPath, CODEX_PROVIDER_BLOCK, "utf8"); L64: return "configured"; ... L75: } L76: writeFileSync(configPath, `${current}${separator}${CODEX_PROVIDER_BLOCK}`, "utf8"); L77: return "configured";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skill.mjsView on unpkg · L8

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: t agent of codex_agents) { const result = ensurecodexagent(agentdir, agent); process.stderr.write(`llm-relay: codex agent ${result.status} at ${result.path}\n`); } } try { const force = process.argv.includes("--force"); const here = dirname(fileurltopath(import.meta.url)); const pkgdir = join(here, ".."); const normalizedpkgdir = pkgdir.replace(/\\/g, "/"); const cleanpkgdir = normalizedpkgdir.endswith("/") ? normalizedpkgdi

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-skill.mjsView on unpkg

dist/claude-hook.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { existssync, mkdirsync, readfilesync, writefilesync } from "node:fs"; import { join } from "node:path"; import { homedir } from "node:os";

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/claude-hook.jsView on unpkg

scripts/sync-tiers.mjsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.33.0 matchedPath = scripts/sync-tiers.mjs matchedIdentity = npm:bGxtLXJlbGF5:0.33.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-tiers.mjsView on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = llm-relay@0.34.0 matchedIdentity = npm:bGxtLXJlbGF5:0.34.0 similarity = 0.411 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 23-63json

23 "docs/dashboard-bundle-inventory.json",

24 "skills",

25 "scripts/install-skill.mjs",

26 "scripts/sync-tiers.mjs",

27 "scripts/tier-scoring.mjs",

28 "scripts/tier-scoring.d.mts",

29 "README.md",

30 "LICENSE",

31 "THIRD_PARTY_NOTICES.md",

32 "config.example.json"

33 ],

34 "scripts": {

35 "build": "npm run build:server && npm run build:dashboard",

36 "dev": "tsx src/cli.ts",

37 "start": "node dist/cli.js",

38 "sync:tiers": "node scripts/sync-tiers.mjs",

39 "test": "vitest run",

40 "typecheck": "tsc -p tsconfig.json --noEmit",

41 "typecheck:test": "tsc -p tsconfig.test.json",

42 "check": "npm run typecheck && npm run typecheck:test && npm test && npm run check:dashboard && npm run check:package",

43 "postinstall": "node scripts/install-skill.mjs || node -e \"process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The package itself is fine. Retry with: node scripts/install-skill.mjs --force\\n')\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L43

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

44 "analysis:run": "node scripts/analysis-run.mjs",

45 "prepack": "npm run build",

46 "prepublishOnly": "npm run build && npm run check",

47 "build:server": "node scripts/clean-dist.mjs && tsc -p tsconfig.json",

48 "build:dashboard": "vite build --config dashboard/vite.config.ts",

49 "check:dashboard": "tsc -p dashboard/tsconfig.json --noEmit && vitest run --config dashboard/vitest.config.ts",

50 "check:package": "node scripts/dashboard-package-check.mjs && node scripts/packed-dashboard-smoke.mjs"

51 },

52 "dependencies": {

53 "ajv": "^8.17.1",

54 "llm-bridge": "^2.0.1"

55 },

56 "devDependencies": {

57 "@eslint/js": "^10.0.1",

58 "@testing-library/jest-dom": "^6.9.1",

59 "@testing-library/react": "^16.3.2",

60 "@testing-library/user-event": "^14.6.5",

61 "@types/node": "^22.10.0",

62 "@types/react": "^19.2.18",

63 "@types/react-dom": "^19.2.4",

dist/self-update.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/self-update.js: import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, readdirSync, writeFileSync } from "node:fs"; const REGISTRY = "https://registry.npmjs.org"; writeFileSync(cacheFile(), JSON.stringify({ checkedAt: now, latest }), "utf8");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/self-update.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = llm-relay@0.17.0 matchedPath = dist/self-update.js matchedIdentity = npm:bGxtLXJlbGF5:0.17.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/self-update.jsView on unpkg

scripts/install-skill.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * Install/refresh the llm-relay skill for Claude Code and Codex from the same

4 * shipped source (skills/llm-relay/SKILL.md), and provision Codex's global

5 * provider/child-agent setup.

6 *

7 * Runs from npm `postinstall`, but only acts on GLOBAL installs (`npm i -g llm-relay`)

8 * so that a repo-local `npm install` (dev checkout, CI) never touches the developer's

9 * ~/.claude or ~/.codex. Because the self-updater reinstalls the global package on a new

10 * version, both skill descriptions and the missing Codex setup refresh on every upgrade with

dist/claude-hook.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { existssync, mkdirsync, readfilesync, writefilesync } from "node:fs"; import { join } from "node:path"; import { homedir } from "node:os";

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/claude-hook.jsView on unpkg

scripts/sync-tiers.mjsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.33.0 matchedPath = scripts/sync-tiers.mjs matchedIdentity = npm:bGxtLXJlbGF5:0.33.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-tiers.mjsView on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = llm-relay@0.34.0 matchedIdentity = npm:bGxtLXJlbGF5:0.34.0 similarity = 0.411 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg