Loading npm security reports…

llm-relay@0.57.0: AI-agent control-surface risk | LPM Firewall

registry / llm-relay / 0.57.0

llm-relay@0.57.0

Loopback bidirectional Anthropic/OpenAI API proxy with tool-call validation and multi-provider routing.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically alters Codex configuration and agent definitions, and installs skills into Claude and Codex directories. Later mutating CLI use can automatically reinstall a newer release and repeat this behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Global installation of the package, or a qualifying mutating CLI command when an update is available.

Impact

Changes global AI-agent routing and creates a default Codex agent without an explicit setup command.

Mechanism

Postinstall AI-agent configuration injection with automatic global self-update.

Policy narrative

Installing this package globally launches its postinstall hook. The hook writes a new Codex model provider, creates a default agent that uses it, and copies package-controlled skills into two agent products' global directories. The CLI can then check the npm registry and globally install a newer release, which causes the hook to run again. This is an unconsented lifecycle mutation of broad, foreign AI-agent control surfaces.

AI rationale

The automatic global postinstall changes Codex and Claude control surfaces, including a default Codex agent, and a self-updater repeats the lifecycle path. Local-install safeguards and non-overwrite behavior do not remove the global-install attack surface.

Evidence

package.jsonscripts/install-skill.mjsdist/self-update.js~/.codex/config.toml~/.codex/agents/default.toml~/.codex/agents/relay_coding.toml~/.codex/skills/llm-relay/SKILL.md

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.mjs || node -e "process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The p...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-skill.mjs || node -e "process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The p...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/install-skill.mjsView file

8* so that a repo-local `npm install` (dev checkout, CI) never touches the developer's L9: * ~/.claude or ~/.codex. Because the self-updater reinstalls the global package on a new L10: * version, both skill descriptions and the missing Codex setup refresh on every upgrade with ... L22: */ L23: import { copyFileSync, mkdirSync, existsSync, readFileSync, writeFileSync } from "node:fs"; L24: import { join, dirname } from "node:path"; ... L62: if (!existsSync(configPath)) { L63: writeFileSync(configPath, CODEX_PROVIDER_BLOCK, "utf8"); L64: return "configured"; ... L75: } L76: writeFileSync(configPath, `${current}${separator}${CODEX_PROVIDER_BLOCK}`, "utf8"); L77: return "configured";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skill.mjsView on unpkg · L8

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: t agent of codex_agents) { const result = ensurecodexagent(agentdir, agent); process.stderr.write(`llm-relay: codex agent ${result.status} at ${result.path}\n`); } } try { const force = process.argv.includes("--force"); const here = dirname(fileurltopath(import.meta.url)); const pkgdir = join(here, ".."); const normalizedpkgdir = pkgdir.replace(/\\/g, "/"); const cleanpkgdir = normalizedpkgdir.endswith("/") ? normalizedpkgdi

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-skill.mjsView on unpkg

dist/delegate-gate/diff-parser.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/delegate-gate/diff-parser.js#virtual:normalized:round1View on unpkg

dist/self-update.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.77.1 matchedPath = dist/self-update.js matchedIdentity = npm:bGxtLXJlbGF5:0.77.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/self-update.jsView on unpkg

dist/os-keyring.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.59.3 matchedPath = dist/os-keyring.js matchedIdentity = npm:bGxtLXJlbGF5:0.59.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/os-keyring.jsView on unpkg

dist/secret-file-acl.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.62.0 matchedPath = dist/secret-file-acl.js matchedIdentity = npm:bGxtLXJlbGF5:0.62.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/secret-file-acl.jsView on unpkg

dist/winenv.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.77.1 matchedPath = dist/winenv.js matchedIdentity = npm:bGxtLXJlbGF5:0.77.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/winenv.jsView on unpkg

scripts/sync-tiers.mjsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.77.1 matchedPath = scripts/sync-tiers.mjs matchedIdentity = npm:bGxtLXJlbGF5:0.77.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-tiers.mjsView on unpkg

dist/config.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.62.0 matchedPath = dist/config.js matchedIdentity = npm:bGxtLXJlbGF5:0.62.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config.jsView on unpkg

dist/accounting-store-schema.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.62.0 matchedPath = dist/accounting-store-schema.js matchedIdentity = npm:bGxtLXJlbGF5:0.62.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/accounting-store-schema.jsView on unpkg

dist/accounting-store.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.62.0 matchedPath = dist/accounting-store.js matchedIdentity = npm:bGxtLXJlbGF5:0.62.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/accounting-store.jsView on unpkg

dist/backend.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.62.0 matchedPath = dist/backend.js matchedIdentity = npm:bGxtLXJlbGF5:0.62.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/backend.jsView on unpkg

dist/dashboard-routes.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.70.0 matchedPath = dist/dashboard-routes.js matchedIdentity = npm:bGxtLXJlbGF5:0.70.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dashboard-routes.jsView on unpkg

dist/quota-observation.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.62.0 matchedPath = dist/quota-observation.js matchedIdentity = npm:bGxtLXJlbGF5:0.62.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/quota-observation.jsView on unpkg

dist/reshaper.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.77.1 matchedPath = dist/reshaper.js matchedIdentity = npm:bGxtLXJlbGF5:0.77.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/reshaper.jsView on unpkg