Loading npm security reports…

llm-relay@0.59.1: AI-agent control-surface risk | LPM Firewall

registry / llm-relay / 0.59.1

llm-relay@0.59.1

Loopback bidirectional Anthropic/OpenAI API proxy with tool-call validation and multi-provider routing.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm installation automatically modifies Codex and Claude Code host configuration. It adds a relay provider and a default-named Codex agent without a separate setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package globally through npm activates postinstall.

Impact

Future Codex child-agent traffic can be routed through the package's local relay, and package-controlled skills are installed into two agent hosts.

Mechanism

Automatic lifecycle writes to AI-agent configuration and skill directories.

Policy narrative

A global installation executes postinstall and writes a new model provider into the user's Codex configuration. It then creates a default-named Codex agent that selects that provider and copies package-controlled skills into Codex and Claude Code. This is an unconsented lifecycle mutation of broad, foreign AI-agent control surfaces. The package also contains a registry-driven global self-updater, increasing the persistence of later package changes.

Rationale

The global-only guard limits scope, but it does not make the automatic writes to ~/.codex/config.toml and a default agent user-invoked. This is a concrete postinstall AI-agent control-surface mutation and warrants blocking. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.

Evidence

package.jsonscripts/install-skill.mjsdist/self-update.js~/.codex/config.toml~/.codex/agents/default.toml~/.codex/agents/relay_coding.toml

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.mjs || node -e "process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The p...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-skill.mjs || node -e "process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The p...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/self-update.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/self-update.js: import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, readdirSync, writeFileSync } from "node:fs"; const REGISTRY = "https://registry.npmjs.org"; writeFileSync(cacheFile(), JSON.stringify({ checkedAt: now, latest }), "utf8");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/self-update.jsView on unpkg

scripts/install-skill.mjsView file

8* so that a repo-local `npm install` (dev checkout, CI) never touches the developer's L9: * ~/.claude or ~/.codex. Because the self-updater reinstalls the global package on a new L10: * version, both skill descriptions and the missing Codex setup refresh on every upgrade with ... L22: */ L23: import { copyFileSync, mkdirSync, existsSync, readFileSync, writeFileSync } from "node:fs"; L24: import { join, dirname } from "node:path"; ... L62: if (!existsSync(configPath)) { L63: writeFileSync(configPath, CODEX_PROVIDER_BLOCK, "utf8"); L64: return "configured"; ... L75: } L76: writeFileSync(configPath, `${current}${separator}${CODEX_PROVIDER_BLOCK}`, "utf8"); L77: return "configured";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skill.mjsView on unpkg · L8

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: t agent of codex_agents) { const result = ensurecodexagent(agentdir, agent); process.stderr.write(`llm-relay: codex agent ${result.status} at ${result.path}\n`); } } try { const force = process.argv.includes("--force"); const here = dirname(fileurltopath(import.meta.url)); const pkgdir = join(here, ".."); const normalizedpkgdir = pkgdir.replace(/\\/g, "/"); const cleanpkgdir = normalizedpkgdir.endswith("/") ? normalizedpkgdi

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-skill.mjsView on unpkg

dist/os-keyring.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.50.0 matchedPath = dist/os-keyring.js matchedIdentity = npm:bGxtLXJlbGF5:0.50.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/os-keyring.jsView on unpkg

dist/secret-file-acl.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.50.0 matchedPath = dist/secret-file-acl.js matchedIdentity = npm:bGxtLXJlbGF5:0.50.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/secret-file-acl.jsView on unpkg

dist/winenv.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.50.0 matchedPath = dist/winenv.js matchedIdentity = npm:bGxtLXJlbGF5:0.50.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/winenv.jsView on unpkg

dist/config.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.50.0 matchedPath = dist/config.js matchedIdentity = npm:bGxtLXJlbGF5:0.50.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config.jsView on unpkg

dist/accounting-store-schema.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.50.0 matchedPath = dist/accounting-store-schema.js matchedIdentity = npm:bGxtLXJlbGF5:0.50.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/accounting-store-schema.jsView on unpkg

dist/dashboard-routes.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.50.0 matchedPath = dist/dashboard-routes.js matchedIdentity = npm:bGxtLXJlbGF5:0.50.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dashboard-routes.jsView on unpkg

dist/quota-observation.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.50.0 matchedPath = dist/quota-observation.js matchedIdentity = npm:bGxtLXJlbGF5:0.50.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/quota-observation.jsView on unpkg

dist/reshaper.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.50.0 matchedPath = dist/reshaper.js matchedIdentity = npm:bGxtLXJlbGF5:0.50.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/reshaper.jsView on unpkg

dist/responses-request.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.50.0 matchedPath = dist/responses-request.js matchedIdentity = npm:bGxtLXJlbGF5:0.50.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/responses-request.jsView on unpkg

dist/lane-quota-probe.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = llm-relay@0.59.0 matchedIdentity = npm:bGxtLXJlbGF5:0.59.0 similarity = 0.982 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lane-quota-probe.jsView on unpkg