registry / Data exfiltration / totem-llm

totem-llm

Totem LLM – Your Private AI. Run a self-hosted AI assistant locally on Linux, macOS, or Windows.

This report shows the evidence for totem-llm@0.15.1. 1 of 9 known versions is blocked or flagged. The newest version, 0.19.0, is allowed. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

A hard-coded production credential combined with a default remote provider creates a concrete, unconsented runtime data-egress path. This is more than the scanner's generic network findings, though it is not install-time AI-agent control hijacking.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs totem-llm and uses chat with the default configuration.

Impact

User chat prompts and attached content can leave the self-hosted application without the user supplying or selecting that provider.

Mechanism

bundled remote LLM credential and default provider route chat messages externally

Attack narrative

The shipped server configuration defaults to OpenRouter and embeds an API credential. The OpenRouter provider constructs a remote client with that credential and passes chat messages to it. Therefore, after explicit application startup, user prompts are routed off-device despite the package describing itself as private/self-hosted. The install hook performs dependency setup only and is not the exfiltration trigger.

AI rationale

Evidence

server/.envserver/utils/AiProviders/openRouter/index.jsscripts/postinstall.mjsbin/totem-llm.js

Network endpoints1

openrouter.ai/api/v1

Decision evidence

public snapshot

AI called this Malicious at 92.0% confidence as Malware with low false-positive risk.

Evidence for block

Bundled server/.env defaults LLM_PROVIDER to openrouter and contains a hard-coded OpenRouter credential.
Runtime OpenRouter client reads that credential and targets openrouter.ai.
Chat completion forwards the constructed messages to the remote client.
postinstall only installs declared server/collector dependencies and generates Prisma; no agent-control writes found.

Evidence against

CLI startup and setup actions are explicit user commands.
Web-search API keys are checked before use and are tied to configured search providers.
No credential harvesting, eval-based payload loading, or foreign AI-agent configuration mutation was found in inspected paths.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStrings

Source & flagged code

9 flagged

package.jsonView file

Lines 39-79json

39 "setup": "cd server && yarn && cd ../collector && yarn && cd ../frontend && yarn && cd .. && yarn setup:envs && yarn prisma:setup && echo \"Please run yarn dev:server, yarn dev:collector, and yarn dev:frontend in separate terminal tabs.\"",

40 "setup:envs": "node scripts/setup-envs.mjs",

41 "dev:server": "cd server && yarn dev",

42 "dev:collector": "cd collector && yarn dev",

43 "dev:frontend": "cd frontend && yarn dev",

44 "dev:all": "npx concurrently \"yarn dev:server\" \"yarn dev:frontend\" \"yarn dev:collector\"",

45 "prisma:generate": "cd server && npx prisma generate",

46 "prisma:migrate": "cd server && npx prisma migrate dev --name init",

47 "prisma:seed": "cd server && npx prisma db seed",

48 "prisma:setup": "yarn prisma:generate && yarn prisma:migrate && yarn prisma:seed",

49 "prisma:reset": "node -e \"const{writeFileSync,existsSync}=require('fs');const p='server/storage/anythingllm.db';if(existsSync(p)){writeFileSync(p,'');console.log('Database cleared.')}\" && yarn prisma:migrate",

50 "prod:server": "cd server && yarn start",

51 "prod:frontend": "cd frontend && yarn build",

52 "generate:cloudformation": "node cloud-deployments/aws/cloudformation/generate.mjs",

53 "generate::gcp_deployment": "node cloud-deployments/gcp/deployment/generate.mjs",

54 "translations:verify": "cd frontend/src/locales && node verifyTranslations.mjs",

55 "translations:normalize": "cd frontend/src/locales && node normalizeEn.mjs && cd ../../.. && cd frontend && yarn lint && cd .. && yarn translations:verify",

56 "translations:prune": "cd frontend/src/locales && node findUnusedTranslations.mjs --delete && cd ../../../ && yarn translations:normalize",

57 "translations:create": "cd extras/translator && node index.mjs --all && cd ../../frontend && yarn lint && cd ../..",

58 "prepublishOnly": "node scripts/build-frontend.mjs",

59 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L59

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L59

60 "test:install": "node scripts/test-install.mjs"

61 },

62 "private": false,

63 "devDependencies": {

64 "@babel/core": "^8.0.1",

65 "@babel/preset-env": "^8.0.2",

66 "@commitlint/cli": "^21.2.1",

67 "@commitlint/config-conventional": "^21.2.0",

68 "@langchain/textsplitters": "^1.0.1",

69 "babel-jest": "^30.4.1",

70 "concurrently": "^9.1.2",

71 "dotenv": "^17.4.2",

72 "fix-path": "^5.0.0",

73 "jest": "^29.7.0",

74 "jsonwebtoken": "^9.0.3",

75 "lodash": "^4.18.1",

76 "pg": "^8.22.0",

77 "slugify": "^1.6.9",

78 "standard-version": "^9.5.0",

79 "uuid": "^14.0.1"

server/.envView file

Lines 1-19text

1# Auto-dump ENV from system call on 22:15:04 GMT-0400 (Eastern Daylight Time)

2LLM_PROVIDER='openrouter'

3OLLAMA_BASE_PATH='http://127.0.0.1:11434'

4OLLAMA_MODEL_PREF='qwen3.5:2b'

5OLLAMA_MODEL_TOKEN_LIMIT='4096'

6OLLAMA_AUTH_TOKEN='your-ollama-auth-token-here (optional, only for ollama running behind auth - Bearer token)'

7VECTOR_DB='lancedb'

8OPENROUTER_API_KEY='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'

9OPENROUTER_MODEL_PREF='nvidia/nemotron-3-nano-30b-a3b:free'

10OPENROUTER_TIMEOUT_MS='3000'

11WHISPER_PROVIDER='local'

12JWT_SECRET='my-random-string-for-seeding'

server/public/assets/ort.min-faca3c2b.jsView file

4* Licensed under the MIT License. L5: */var vd=Object.create,Pn=Object.defineProperty,_d=Object.getOwnPropertyDescriptor,Od=Object.getOwnPropertyNames,Id=Object.getPrototypeOf,Sd=Object.prototype.hasOwnProperty,L=(e,r)... L6: precision highp float;

High

Eval

Package source references dynamic code evaluation.

server/public/assets/ort.min-faca3c2b.jsView on unpkg · L4

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

server/public/assets/ort.min-faca3c2b.jsView on unpkg

collector/middleware/verifyIntegrity.jsView file

Lines 1-21javascript

1const { CommunicationKey } = require("../utils/comKey");

2const RuntimeSettings = require("../utils/runtimeSettings");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

collector/middleware/verifyIntegrity.jsView on unpkg · L1

server/utils/agents/aibitat/plugins/web-browsing.jsView file

Lines 20-60javascript

20 .toString()

21 .replace(/\B(?=(\d{3})+(?!\d))/g, ","),

22 description:

23 "Search the internet for real-time information. Look online for current news, recent updates, latest changes, or any information not available locally. Browse the web to find answers about current events, prices, weather, or live data."

server/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = totem-llm@0.15.0 matchedIdentity = npm:dG90ZW0tbGxt:0.15.0 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/index.jsView on unpkg

server/endpoints/system.jsView file

Lines 392-432javascript

392 );

393

394 app.post(

395 "/system/reset-password",

396 [isMultiUserSetup],

397 async (request, response) => {

398 try

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

server/.envView file

5patternName = blocked_file severity = critical matchedText = server/.env redactedSecretContext = secretLikeLines = 7 L5: OLLAMA_MODEL_TOKEN_LIMIT=<redacted:4 value> L6: OLLAMA_AUTH_TOKEN=<redacted:90 token-like> L8: OPENROUTER_API_KEY=<redacted:73 token-like> L9: OPENROUTER_MODEL_PREF=<redacted:35 token-like> L12: JWT_SECRET=<redacted:28 token-like> L14: STORAGE_DIR=<redacted:26 token-like> L18: DATABASE_URL=<redacted:30 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

Findings

3 Critical3 High7 Medium6 Low

CriticalCritical Secretserver/.env

CriticalCredential Exfiltrationserver/utils/agents/aibitat/plugins/web-browsing.js

CriticalPrevious Version Dangerous Deltaserver/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighEvalserver/public/assets/ort.min-faca3c2b.js

HighSemantic Analysis Limitedserver/public/assets/ort.min-faca3c2b.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirecollector/middleware/verifyIntegrity.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

Medium

Affected versions and remediation

This report applies to totem-llm@0.15.1.

The versions list below shows the verdict for each recorded version.

Avoid installing totem-llm@0.15.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-26 02:33:46.941Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

9 known versions

0.19.0latestManual Review—AllowUnder ReviewOct 17, 2026, 4:03 PM 0.17.0SuspiciousInstall Hook AbuseWarnPublishedSep 8, 2026, 7:13 PM 0.16.2Clean—AllowPublishedAug 29, 2026, 11:15 PM 0.16.1SuspiciousCredential ExfiltrationWarnPublishedAug 29, 2026, 1:42 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Behavioral surface

Related packages

Other data exfiltration packages

Source & flagged code