Loading npm security reports…

relia-sdk@0.2.34: AI-agent control-surface risk | LPM Firewall

registry / relia-sdk / 0.2.34

relia-sdk@0.2.34

Zero-config observability SDK for [RELIA](https://github.com/relia-platform). Instruments Node.js services, browser sessions, and AI agents with a single CLI command.

AI Security Review

scanned 21d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies a consumer Next.js configuration. In projects using the ai package, it redirects all ai imports through a Relia proxy that captures and transmits LLM run content.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm postinstall in a Next.js project; the ai alias is added when the project declares ai.

Impact

Application prompts, model answers, and tool inputs and outputs can be disclosed to Relia without an explicit setup action.

Mechanism

Unconsented AI-module aliasing followed by LLM telemetry exfiltration.

Policy narrative

The install hook discovers a consumer Next.js project and changes its configuration. If the project uses the ai package, the hook installs an alias that substitutes Relia's bridge for the application's ai module. That bridge preserves normal exports while wrapping text-generation calls, building records from prompts, answers, and tool data, then posting them to Relia's endpoint. This is an unconsented postinstall change to a foreign AI-agent control surface.

AI rationale

This is a concrete automatic install-time AI control-surface hijack with subsequent disclosure of application LLM content. The behavior meets the publish-block policy regardless of the package's stated telemetry purpose.

Evidence

package.jsondist/postinstall.cjsdist/next-setup.cjsdist/agent/ai-bridge.cjsdist/agent/core.cjsnext.config.tsnext.config.mjsnext.config.js

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "if (require('fs').existsSync('./dist/postinstall.cjs')) require('./dist/postinstall.cjs');"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "if (require('fs').existsSync('./dist/postinstall.cjs')) require('./dist/postinstall.cjs');"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/node.cjsView file

6exports.start = start; L7: const auto_instrumentations_node_1 = require("@opentelemetry/auto-instrumentations-node"); L8: const exporter_trace_otlp_http_1 = require("@opentelemetry/exporter-trace-otlp-http");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/node.cjsView on unpkg · L6

dist/index.jsView file

725} L726: const Uo = /url\((?:(')([^']*)'|(")(.*?)"|([^)]*))\)/gm, zo = /^(?:[a-z+]+:)?\/\//i, Wo = /^www\..*/i, Bo = /^(data:)([^,]*),(.*)/i; L727: function wt(e, t) { ... L2024: function f(i) { L2025: return Buffer ? Buffer.from(i, "base64").toString() : window.atob(i); L2026: } ... L3227: } catch (i) { L3228: throw process.env.NODE_ENV !== "production" && i.name === "CssSyntaxError" && l && l.from && (/\.scss$/i.test(l.from) ? i.message += ` L3229: You tried to parse SCSS with the standard CSS parser; try again with the postcss-scss parser` : /\.sass/i.test(l.from) ? i.message += ` ... L3740: x + `: postcss.plugin was deprecated. Migration guide: L3741: https://evilmartians.com/chronicles/postcss-8-plugin-migration` L3742: ), process.env.LANG && process.env.LANG.startsWith("cn") &&

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.jsView on unpkg · L725

dist/cli.cjsView file

23exports.main = main; L24: const node_child_process_1 = require("node:child_process"); L25: const node_fs_1 = __importDefault(require("node:fs")); ... L32: const next_setup_cjs_1 = require("./next-setup.cjs"); L33: exports.DEFAULT_API_BASE = "https://devreliaapi.tryrelia.com"; L34: exports.DEFAULT_OTLP_ENDPOINT = "https://devotel.tryrelia.com/v1/traces"; ... L42: try { L43: return JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.resolve(p), "utf8")); L44: } ... L55: }; L56: const AUTH_FILE_PATH = node_path_1.default.join(node_os_1.default.homedir(), ".relia", "auth.json"); L57: function getStoredCliAuth() {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.cjsView on unpkg · L23

23Trigger-reachable chain: manifest.exports -> dist/cli.cjs L23: exports.main = main; L24: const node_child_process_1 = require("node:child_process"); L25: const node_fs_1 = __importDefault(require("node:fs")); ... L32: const next_setup_cjs_1 = require("./next-setup.cjs"); L33: exports.DEFAULT_API_BASE = "https://devreliaapi.tryrelia.com"; L34: exports.DEFAULT_OTLP_ENDPOINT = "https://devotel.tryrelia.com/v1/traces"; ... L42: try { L43: return JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.resolve(p), "utf8")); L44: } ... L55: }; L56: const AUTH_FILE_PATH = node_path_1.default.join(node_os_1.default.homedir(), ".relia", "auth.json"); L57: function getStoredCliAuth() {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.cjsView on unpkg · L23

•matchType = previous_version_dangerous_delta matchedPackage = relia-sdk@0.2.32 matchedIdentity = npm:cmVsaWEtc2Rr:0.2.32 similarity = 0.854 summary = stored previous version shares package body but lacks this dangerous source file

dist/auto.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/auto.cjs#virtual:normalized:round1View on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 37-77json

37 "./auto": {

38 "types": "./dist/auto.d.cts",

39 "require": "./dist/auto.cjs",

40 "import": "./dist/auto.mjs",

41 "default": "./dist/auto.cjs"

42 }

43 },

44 "bin": {

45 "relia": "dist/cli.cjs"

46 },

47 "files": [

48 "dist"

49 ],

50 "engines": {

51 "node": ">=18"

52 },

53 "scripts": {

54 "build": "vite build && tsc --emitDeclarationOnly && tsc -p tsconfig.node.json",

55 "test": "vitest run",

56 "test:watch": "vitest",

57 "postinstall": "node -e \"if (require('fs').existsSync('./dist/postinstall.cjs')) require('./dist/postinstall.cjs');\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L57

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

58 },

59 "dependencies": {

60 "@opentelemetry/api": "^1.9.1",

61 "@opentelemetry/auto-instrumentations-node": "^0.79.0",

62 "@opentelemetry/exporter-trace-otlp-http": "^0.221.0",

63 "@opentelemetry/instrumentation-express": "^0.69.0",

64 "@opentelemetry/instrumentation-http": "^0.221.0",

65 "@opentelemetry/resources": "^2.10.0",

66 "@opentelemetry/sdk-node": "^0.221.0",

67 "@opentelemetry/semantic-conventions": "^1.43.0",

68 "rrweb": "^2.0.0-alpha.14"

69 },

70 "devDependencies": {

71 "@types/node": "^22.0.0",

72 "jsdom": "^26.0.0",

73 "typescript": "~6",

74 "vite": "^7.0.0",

75 "vitest": "^3.2.4"

76 }

77}

dist/node.cjsView file

Lines 1-26javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.expressMiddleware = exports.expressErrorHandler = exports.buildResourceAttributes = exports.buildInstrumentationConfig =

dist/index.jsView file

Lines 705-745javascript

705function yt(e) {

706 const t = e.type;

707 return e.hasAttribute("data-rr-is-password") ? "password" : t

dist/cli.cjsView file

Lines 3-43javascript

3var __importDefault = (this && this.__importDefault) || function (mod) {

4 return (mod && mod.__esModule) ? mod : { "default": mod };

dist/auto.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/auto.cjs#virtual:normalized:round1View on unpkg