registry / relia-sdk / 0.2.14

relia-sdk@0.2.14

Zero-config observability SDK for [RELIA](https://github.com/relia-platform). Instruments Node.js services, browser sessions, and AI agents with a single CLI command.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package automatically changes a consumer Next.js configuration. In AI SDK projects it redirects the broad ai module to Relia code that collects and reports LLM conversation and tool data.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation in a detected Next.js project; the AI interception activates in projects that also use the AI SDK.

Impact

Consumer AI prompts, answers, and tool inputs and outputs can be sent to a third-party Relia endpoint without an explicit setup command.

Mechanism

Postinstall AI-module aliasing followed by agent-run telemetry exfiltration.

Attack narrative

The npm postinstall hook discovers a consumer Next.js project and edits its configuration without asking. When the project also depends on the AI SDK, it inserts a Turbopack alias that replaces the broad ai module with relia-sdk/ai-bridge. The package’s agent instrumentation records prompt, answer, and tool-call data and posts it to Relia. This creates an automatic supply-chain path from installation to interception of an application’s AI control surface and sensitive conversation data.

Rationale

This is unconsented postinstall mutation of a foreign, broad AI-agent control surface, followed by collection and network transmission of AI interaction content. The conditional guards do not provide user consent for the install-time rewrite.

Evidence

package.jsondist/postinstall.cjsdist/next-setup.cjsdist/auto.cjsdist/index.jsnext.config.tsnext.config.mjsnext.config.jsnext.config.cjs

Network endpoints1

devreliaapi.tryrelia.com/api/v1/agents/runs

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The package runs a postinstall hook automatically during npm installation.
Postinstall detects a consumer Next.js project and rewrites its configuration.
For projects using the AI SDK, the rewrite aliases the broad ai module to relia-sdk/ai-bridge.
The runtime captures LLM prompts, responses, tool arguments, and tool outputs.
Captured agent-run data is posted to the Relia API endpoint.

Evidence against

The install-time mutation is limited to detected Next.js projects, with the AI alias gated on an AI SDK dependency.
No self-dependency or hidden binary payload appears in the manifest.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 37 file(s), 471 KB of source, external domains: 127.0.0.1, devotel.tryrelia.com, devreliaapi.tryrelia.com, evilmartians.com, www.w3ctech.com

Source & flagged code

8 flagged

package.jsonView file

Lines 37-77json

37 "./auto": {

38 "types": "./dist/auto.d.cts",

39 "require": "./dist/auto.cjs",

40 "import": "./dist/auto.mjs",

41 "default": "./dist/auto.cjs"

42 }

43 },

44 "bin": {

45 "relia": "./dist/cli.cjs"

46 },

47 "files": [

48 "dist"

49 ],

50 "engines": {

51 "node": ">=18"

52 },

53 "scripts": {

54 "build": "vite build && tsc --emitDeclarationOnly && tsc -p tsconfig.node.json",

55 "test": "vitest run",

56 "test:watch": "vitest",

57 "postinstall": "node -e \"if (require('fs').existsSync('./dist/postinstall.cjs')) require('./dist/postinstall.cjs');\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L57

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

58 },

59 "dependencies": {

60 "@opentelemetry/api": "^1.9.1",

61 "@opentelemetry/auto-instrumentations-node": "^0.79.0",

62 "@opentelemetry/exporter-trace-otlp-http": "^0.221.0",

63 "@opentelemetry/instrumentation-express": "^0.69.0",

64 "@opentelemetry/instrumentation-http": "^0.221.0",

65 "@opentelemetry/resources": "^2.10.0",

66 "@opentelemetry/sdk-node": "^0.221.0",

67 "@opentelemetry/semantic-conventions": "^1.43.0",

68 "rrweb": "^2.0.0-alpha.14"

69 },

70 "devDependencies": {

71 "@types/node": "^22.0.0",

72 "jsdom": "^26.0.0",

73 "typescript": "~6",

74 "vite": "^7.0.0",

75 "vitest": "^3.2.4"

76 }

77}

dist/node.cjsView file

Lines 1-26javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.expressMiddleware = exports.expressErrorHandler = exports.buildResourceAttributes = exports.buildInstrumentationConfig =

dist/index.jsView file

Lines 705-745javascript

705function gt(e) {

706 const t = e.type;

707 return e.hasAttribute("data-rr-is-password") ? "password" : t

dist/cli.cjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2"use strict";

3var __importDefault = (this && this.__importDefault) || function (mod) {

4 return (mod && mod.__esModule) ?

dist/auto.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/auto.cjs#virtual:normalized:round1View on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "if (require('fs').existsSync('./dist/postinstall.cjs')) require('./dist/postinstall.cjs');"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "if (require('fs').existsSync('./dist/postinstall.cjs')) require('./dist/postinstall.cjs');"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/node.cjsView file

6exports.start = start; L7: const auto_instrumentations_node_1 = require("@opentelemetry/auto-instrumentations-node"); L8: const exporter_trace_otlp_http_1 = require("@opentelemetry/exporter-trace-otlp-http");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/node.cjsView on unpkg · L6

dist/index.jsView file

725} L726: const Fo = /url$(?:(')([^']*)'|(")(.*?)"|([^)]*))$/gm, Uo = /^(?:[a-z+]+:)?\/\//i, zo = /^www\..*/i, Bo = /^(data:)([^,]*),(.*)/i; L727: function yt(e, t) { ... L2024: function f(i) { L2025: return Buffer ? Buffer.from(i, "base64").toString() : window.atob(i); L2026: } ... L3227: } catch (i) { L3228: throw process.env.NODE_ENV !== "production" && i.name === "CssSyntaxError" && l && l.from && (/\.scss$/i.test(l.from) ? i.message += ` L3229: You tried to parse SCSS with the standard CSS parser; try again with the postcss-scss parser` : /\.sass/i.test(l.from) ? i.message += ` ... L3740: x + `: postcss.plugin was deprecated. Migration guide: L3741: https://evilmartians.com/chronicles/postcss-8-plugin-migration` L3742: ), process.env.LANG && process.env.LANG.startsWith("cn") &&

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.jsView on unpkg · L725

dist/cli.cjsView file

20exports.main = main; L21: const node_child_process_1 = require("node:child_process"); L22: const node_fs_1 = __importDefault(require("node:fs")); ... L29: const next_setup_cjs_1 = require("./next-setup.cjs"); L30: exports.DEFAULT_OTLP_ENDPOINT = "https://devotel.tryrelia.com/v1/traces"; L31: exports.DEFAULT_SESSION_ENDPOINT = "https://devreliaapi.tryrelia.com/api/v1"; ... L38: try { L39: return JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.resolve(p), "utf8")); L40: } ... L51: }; L52: const AUTH_FILE_PATH = node_path_1.default.join(node_os_1.default.homedir(), ".relia", "auth.json"); L53: function getStoredCliAuth() {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.cjsView on unpkg · L20

20Trigger-reachable chain: manifest.exports -> dist/cli.cjs L20: exports.main = main; L21: const node_child_process_1 = require("node:child_process"); L22: const node_fs_1 = __importDefault(require("node:fs")); ... L29: const next_setup_cjs_1 = require("./next-setup.cjs"); L30: exports.DEFAULT_OTLP_ENDPOINT = "https://devotel.tryrelia.com/v1/traces"; L31: exports.DEFAULT_SESSION_ENDPOINT = "https://devreliaapi.tryrelia.com/api/v1"; ... L38: try { L39: return JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.resolve(p), "utf8")); L40: } ... L51: }; L52: const AUTH_FILE_PATH = node_path_1.default.join(node_os_1.default.homedir(), ".relia", "auth.json"); L53: function getStoredCliAuth() {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.cjsView on unpkg · L20

20Trigger-reachable credential exfiltration chain: manifest.exports -> dist/cli.cjs L20: exports.main = main; L21: const node_child_process_1 = require("node:child_process"); L22: const node_fs_1 = __importDefault(require("node:fs")); ... L29: const next_setup_cjs_1 = require("./next-setup.cjs"); L30: exports.DEFAULT_OTLP_ENDPOINT = "https://devotel.tryrelia.com/v1/traces"; L31: exports.DEFAULT_SESSION_ENDPOINT = "https://devreliaapi.tryrelia.com/api/v1"; ... L38: try { L39: return JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.resolve(p), "utf8")); L40: } ... L51: }; L52: const AUTH_FILE_PATH = node_path_1.default.join(node_os_1.default.homedir(), ".relia", "auth.json"); L53: function getStoredCliAuth() {

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/cli.cjsView on unpkg · L20

dist/auto.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/auto.cjs#virtual:normalized:round1View on unpkg

Findings

3 Critical4 High4 Medium5 Low

CriticalRed Install Lifecycle Scriptpackage.json

CriticalCredential Exfiltrationdist/cli.cjs

CriticalTrigger Reachable Dangerous Capabilitydist/cli.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighBrowser Session Account Hijackdist/index.js

HighTrigger Reachable Credential Exfiltrationdist/cli.cjs

HighSemantic Analysis Limiteddist/auto.cjs#virtual:normalized:round1

MediumDynamic Requiredist/node.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings