Loading npm security reports…

llm-relay@0.64.1: Malicious npm security report (Block) | LPM Firewall

registry / llm-relay / 0.64.1

llm-relay@0.64.1

Loopback bidirectional Anthropic/OpenAI API proxy with tool-call validation and multi-provider routing.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Global npm installation automatically changes several AI-agent configuration surfaces. It installs skills and configures Codex child agents to use this package's relay without a separate setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package globally, and later running a mutating CLI command when an update is available.

Impact

It can redirect Codex child-agent traffic to the local relay and persist package-controlled skills across supported agent tools.

Mechanism

Postinstall AI-agent configuration injection with automatic global self-update.

Attack narrative

The package registers a postinstall hook that, on global installation, writes into Claude Code, Codex, and OpenCode configuration directories. It adds a Codex model provider backed by the package's loopback relay and creates child-agent definitions. Its update logic can globally install a newer release of itself, causing the same postinstall behavior again. This is an unconsented install-time mutation of multiple AI-agent control surfaces.

Rationale

The source establishes a concrete automatic lifecycle path that modifies foreign AI-agent settings and agent definitions, then persists it through automatic global self-updates. This meets the install-hook abuse blocking policy.

Evidence

package.jsonscripts/install-skill.mjsdist/self-update.js.claude/skills/llm-relay/SKILL.md.codex/skills/llm-relay/SKILL.md.codex/config.toml.codex/agents/default.toml.codex/agents/relay_coding.toml

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.mjs || node -e "process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The p...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-skill.mjs || node -e "process.stderr.write('llm-relay: the postinstall hook crashed, so the bundled host skills and Codex setup were NOT fully installed. The p...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/install-skill.mjsView file

8* so that a repo-local `npm install` (dev checkout, CI) never touches the developer's L9: * ~/.claude, ~/.codex or the XDG config dir. Because the self-updater reinstalls the global L10: * package on a new version, every host's skill description and the missing Codex setup refresh ... L22: */ L23: import { copyFileSync, mkdirSync, existsSync, readFileSync, writeFileSync } from "node:fs"; L24: import { join, dirname } from "node:path"; ... L62: if (!existsSync(configPath)) { L63: writeFileSync(configPath, CODEX_PROVIDER_BLOCK, "utf8"); L64: return "configured"; ... L75: } L76: writeFileSync(configPath, `${current}${separator}${CODEX_PROVIDER_BLOCK}`, "utf8"); L77: return "configured";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skill.mjsView on unpkg · L8

dist/claude-hook.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { relaystatepath } from "./state-paths.js"; import { existssync, mkdirsync, readfilesync, writefilesync } from "node:fs"; import { join } from "node:path"; import { homedir, tmpdir } from "node:os"; export const agent_hook_filename = "llm-relay-agent-offload.mjs"; export function claudehookpaths(home = homedir()) { if (process.env.vitest && home === homedir()) { const vitesthome = join(tmpdir(), "llm-relay-vitest"); return { settings: join(vitesthome, ".claude", "settings.json"), script: join(vitesthome, "hooks", agent_hook_filename), }; } return { settings: join(home, ".claude", "settings.json"),

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/claude-hook.jsView on unpkg

dist/config.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/config.js#virtual:normalized:round1View on unpkg

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.63.1 matchedPath = dist/cli.js matchedIdentity = npm:bGxtLXJlbGF5:0.63.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

dist/self-update.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.63.1 matchedPath = dist/self-update.js matchedIdentity = npm:bGxtLXJlbGF5:0.63.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/self-update.jsView on unpkg

dist/mcp/lane-runner.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.63.1 matchedPath = dist/mcp/lane-runner.js matchedIdentity = npm:bGxtLXJlbGF5:0.63.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/lane-runner.jsView on unpkg

dist/lane-quota-probe.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.63.1 matchedPath = dist/lane-quota-probe.js matchedIdentity = npm:bGxtLXJlbGF5:0.63.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lane-quota-probe.jsView on unpkg

dist/os-keyring.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.63.1 matchedPath = dist/os-keyring.js matchedIdentity = npm:bGxtLXJlbGF5:0.63.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/os-keyring.jsView on unpkg

dist/refusal-interpretation.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.63.1 matchedPath = dist/refusal-interpretation.js matchedIdentity = npm:bGxtLXJlbGF5:0.63.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/refusal-interpretation.jsView on unpkg

dist/secret-file-acl.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.63.1 matchedPath = dist/secret-file-acl.js matchedIdentity = npm:bGxtLXJlbGF5:0.63.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/secret-file-acl.jsView on unpkg

dist/winenv.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.63.1 matchedPath = dist/winenv.js matchedIdentity = npm:bGxtLXJlbGF5:0.63.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/winenv.jsView on unpkg

scripts/sync-tiers.mjsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.63.1 matchedPath = scripts/sync-tiers.mjs matchedIdentity = npm:bGxtLXJlbGF5:0.63.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-tiers.mjsView on unpkg

dist/accounting-store-schema.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.63.1 matchedPath = dist/accounting-store-schema.js matchedIdentity = npm:bGxtLXJlbGF5:0.63.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/accounting-store-schema.jsView on unpkg

dist/accounting-store.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.63.1 matchedPath = dist/accounting-store.js matchedIdentity = npm:bGxtLXJlbGF5:0.63.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/accounting-store.jsView on unpkg

dist/dashboard-routes.jsView file

•matchType = normalized_sha256 matchedPackage = llm-relay@0.63.1 matchedPath = dist/dashboard-routes.js matchedIdentity = npm:bGxtLXJlbGF5:0.63.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dashboard-routes.jsView on unpkg