Loading npm security reports…

llm-relay@0.38.0: AI-agent control-surface risk | LPM Firewall

registry / llm-relay / 0.38.0

llm-relay@0.38.0

Loopback bidirectional Anthropic/OpenAI API proxy with tool-call validation and multi-provider routing.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Global npm installation silently changes Claude Code and Codex configuration. It adds a relay provider and agent definitions that alter AI-agent routing.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install -g llm-relay

Impact

Subsequent Claude Code and Codex sessions may load package-supplied instructions and route child agents through the relay.

Mechanism

postinstall mutation of foreign AI-agent skills and configuration

Policy narrative

Installing this package globally invokes a postinstall script that writes into Claude Code and Codex home configuration directories without a separate user command. It installs package-controlled skill instructions, adds a loopback model provider, and creates default child-agent configurations. This is a foreign AI-agent control-surface mutation at install time.

Rationale

The global-install guard limits scope but does not make these postinstall changes user-consented. The package automatically modifies external AI-agent configuration and routing surfaces.

Evidence

package.jsonscripts/install-skill.mjs~/.claude/skills/llm-relay/SKILL.md~/.codex/skills/llm-relay/SKILL.md~/.codex/config.toml~/.codex/agents/default.toml~/.codex/agents/relay_coding.toml

Network endpoints1

/v1

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.mjs || node -e "process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The p...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-skill.mjs || node -e "process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The p...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/self-update.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/self-update.js: import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, readdirSync, writeFileSync } from "node:fs"; const REGISTRY = "https://registry.npmjs.org"; writeFileSync(cacheFile(), JSON.stringify({ checkedAt: now, latest }), "utf8");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/self-update.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = llm-relay@0.37.0 matchedPath = dist/self-update.js matchedIdentity = npm:bGxtLXJlbGF5:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/self-update.jsView on unpkg

scripts/install-skill.mjsView file

8* so that a repo-local `npm install` (dev checkout, CI) never touches the developer's L9: * ~/.claude or ~/.codex. Because the self-updater reinstalls the global package on a new L10: * version, both skill descriptions and the missing Codex setup refresh on every upgrade with ... L22: */ L23: import { copyFileSync, mkdirSync, existsSync, readFileSync, writeFileSync } from "node:fs"; L24: import { join, dirname } from "node:path"; ... L62: if (!existsSync(configPath)) { L63: writeFileSync(configPath, CODEX_PROVIDER_BLOCK, "utf8"); L64: return "configured"; ... L75: } L76: writeFileSync(configPath, `${current}${separator}${CODEX_PROVIDER_BLOCK}`, "utf8"); L77: return "configured";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skill.mjsView on unpkg · L8

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: t agent of codex_agents) { const result = ensurecodexagent(agentdir, agent); process.stderr.write(`llm-relay: codex agent ${result.status} at ${result.path}\n`); } } try { const force = process.argv.includes("--force"); const here = dirname(fileurltopath(import.meta.url)); const pkgdir = join(here, ".."); const normalizedpkgdir = pkgdir.replace(/\\/g, "/"); const cleanpkgdir = normalizedpkgdir.endswith("/") ? normalizedpkgdi

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-skill.mjsView on unpkg

dist/claude-hook.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { existssync, mkdirsync, readfilesync, writefilesync } from "node:fs"; import { join } from "node:path"; import { homedir } from "node:os";

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/claude-hook.jsView on unpkg

dist/refusal-interpretation.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.37.0 matchedPath = dist/refusal-interpretation.js matchedIdentity = npm:bGxtLXJlbGF5:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/refusal-interpretation.jsView on unpkg

dist/secret-file-acl.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.37.0 matchedPath = dist/secret-file-acl.js matchedIdentity = npm:bGxtLXJlbGF5:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/secret-file-acl.jsView on unpkg

dist/winenv.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.37.0 matchedPath = dist/winenv.js matchedIdentity = npm:bGxtLXJlbGF5:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/winenv.jsView on unpkg

scripts/sync-tiers.mjsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.37.0 matchedPath = scripts/sync-tiers.mjs matchedIdentity = npm:bGxtLXJlbGF5:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-tiers.mjsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 23-63json

23 "docs/dashboard-bundle-inventory.json",

24 "skills",

25 "scripts/install-skill.mjs",

26 "scripts/sync-tiers.mjs",

27 "scripts/tier-scoring.mjs",

28 "scripts/tier-scoring.d.mts",

29 "README.md",

30 "LICENSE",

31 "THIRD_PARTY_NOTICES.md",

32 "config.example.json"

33 ],

34 "scripts": {

35 "build": "npm run build:server && npm run build:dashboard",

36 "dev": "tsx src/cli.ts",

37 "start": "node dist/cli.js",

38 "sync:tiers": "node scripts/sync-tiers.mjs",

39 "test": "vitest run",

40 "typecheck": "tsc -p tsconfig.json --noEmit",

41 "typecheck:test": "tsc -p tsconfig.test.json",

42 "check": "npm run typecheck && npm run typecheck:test && npm test && npm run check:dashboard && npm run check:package",

43 "postinstall": "node scripts/install-skill.mjs || node -e \"process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The package itself is fine. Retry with: node scripts/install-skill.mjs --force\\n')\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L43

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

44 "analysis:run": "node scripts/analysis-run.mjs",

45 "prepack": "npm run build",

46 "prepublishOnly": "npm run build && npm run check",

47 "build:server": "node scripts/clean-dist.mjs && tsc -p tsconfig.json",

48 "build:dashboard": "vite build --config dashboard/vite.config.ts",

49 "check:dashboard": "tsc -p dashboard/tsconfig.json --noEmit && vitest run --config dashboard/vitest.config.ts",

50 "check:package": "node scripts/dashboard-package-check.mjs && node scripts/packed-dashboard-smoke.mjs"

51 },

52 "dependencies": {

53 "ajv": "^8.17.1",

54 "llm-bridge": "^2.0.1"

55 },

56 "devDependencies": {

57 "@eslint/js": "^10.0.1",

58 "@testing-library/jest-dom": "^6.9.1",

59 "@testing-library/react": "^16.3.2",

60 "@testing-library/user-event": "^14.6.5",

61 "@types/node": "^22.10.0",

62 "@types/react": "^19.2.18",

63 "@types/react-dom": "^19.2.4",

dist/self-update.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/self-update.js: import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, readdirSync, writeFileSync } from "node:fs"; const REGISTRY = "https://registry.npmjs.org"; writeFileSync(cacheFile(), JSON.stringify({ checkedAt: now, latest }), "utf8");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/self-update.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = llm-relay@0.37.0 matchedPath = dist/self-update.js matchedIdentity = npm:bGxtLXJlbGF5:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/self-update.jsView on unpkg

scripts/install-skill.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * Install/refresh the llm-relay skill for Claude Code and Codex from the same

4 * shipped source (skills/llm-relay/SKILL.md), and provision Codex's global

5 * provider/child-agent setup.

6 *

7 * Runs from npm `postinstall`, but only acts on GLOBAL installs (`npm i -g llm-relay`)

8 * so that a repo-local `npm install` (dev checkout, CI) never touches the developer's

9 * ~/.claude or ~/.codex. Because the self-updater reinstalls the global package on a new

10 * version, both skill descriptions and the missing Codex setup refresh on every upgrade with

dist/claude-hook.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { existssync, mkdirsync, readfilesync, writefilesync } from "node:fs"; import { join } from "node:path"; import { homedir } from "node:os";

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/claude-hook.jsView on unpkg

dist/refusal-interpretation.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.37.0 matchedPath = dist/refusal-interpretation.js matchedIdentity = npm:bGxtLXJlbGF5:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/refusal-interpretation.jsView on unpkg

dist/secret-file-acl.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.37.0 matchedPath = dist/secret-file-acl.js matchedIdentity = npm:bGxtLXJlbGF5:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/secret-file-acl.jsView on unpkg

dist/winenv.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.37.0 matchedPath = dist/winenv.js matchedIdentity = npm:bGxtLXJlbGF5:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/winenv.jsView on unpkg

scripts/sync-tiers.mjsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.37.0 matchedPath = scripts/sync-tiers.mjs matchedIdentity = npm:bGxtLXJlbGF5:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-tiers.mjsView on unpkg