Loading npm security reports…

totem-llm@0.15.1: Malicious npm security report (Block) | LPM Firewall

registry / totem-llm / 0.15.1

totem-llm@0.15.1

Totem LLM – Your Private AI. Run a self-hosted AI assistant locally on Linux, macOS, or Windows.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The packaged runtime configuration selects OpenRouter by default and includes a hard-coded credential. When a user starts the service and submits chat content, that content is sent to OpenRouter.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs totem-llm and uses chat with the default configuration.

Impact

User chat prompts and attached content can leave the self-hosted application without the user supplying or selecting that provider.

Mechanism

bundled remote LLM credential and default provider route chat messages externally

Attack narrative

The shipped server configuration defaults to OpenRouter and embeds an API credential. The OpenRouter provider constructs a remote client with that credential and passes chat messages to it. Therefore, after explicit application startup, user prompts are routed off-device despite the package describing itself as private/self-hosted. The install hook performs dependency setup only and is not the exfiltration trigger.

Rationale

A hard-coded production credential combined with a default remote provider creates a concrete, unconsented runtime data-egress path. This is more than the scanner's generic network findings, though it is not install-time AI-agent control hijacking.

Evidence

server/.envserver/utils/AiProviders/openRouter/index.jsscripts/postinstall.mjsbin/totem-llm.js

Network endpoints1

openrouter.ai/api/v1

AI called this Malicious at 92.0% confidence as Malware with low false-positive risk.

Evidence for block

Bundled server/.env defaults LLM_PROVIDER to openrouter and contains a hard-coded OpenRouter credential.
Runtime OpenRouter client reads that credential and targets openrouter.ai.
Chat completion forwards the constructed messages to the remote client.
postinstall only installs declared server/collector dependencies and generates Prisma; no agent-control writes found.

Evidence against

CLI startup and setup actions are explicit user commands.
Web-search API keys are checked before use and are tied to configured search providers.
No credential harvesting, eval-based payload loading, or foreign AI-agent configuration mutation was found in inspected paths.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 580 file(s), 8.56 MB of source, external domains: 0.0.0.0, 127.0.0.1, ai.gitee.com, anythingllm.com, api.bing.microsoft.com, api.cerebras.ai, api.cometapi.com, api.deepseek.com, api.example.com, api.fireworks.ai, api.github.com, api.groq.com, api.minimax.io, api.mistral.ai, api.moonshot.ai, api.novita.ai, api.openai.com, api.perplexity.ai, api.ppinfra.com, api.sambanova.ai, api.serply.io, api.tavily.com, api.telegram.org, api.together.xyz, api.x.ai, api.z.ai, apipie.ai, cdn.anythingllm.com, cdn.jsdelivr.net, cdnjs.cloudflare.com, cloud.baidu.com, console.perplexity.ai, debuginfod.ubuntu.com, developer.mozilla.org, docs.anythingllm.com, docs.github.com, docs.gitlab.com, drupal-wiki.com, drupalwiki.mycompany.tld, exa.ai, example.atlassian.net, example.com, fb.me, generativelanguage.googleapis.com, github.com, gitlab.com, google.serper.dev, graph.microsoft.com, help.drupal-wiki.com, html.duckduckgo.com

Oversized source lightweight scan

server/public/index.js2.70 MB file, sampled 256 KB

NetworkHighEntropyStringsMinifiedUrlStringsreactjs.orgwww.w3.org

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

server/.envView file

5patternName = blocked_file severity = critical matchedText = server/.env redactedSecretContext = secretLikeLines = 7 L5: OLLAMA_MODEL_TOKEN_LIMIT=<redacted:4 value> L6: OLLAMA_AUTH_TOKEN=<redacted:90 token-like> L8: OPENROUTER_API_KEY=<redacted:73 token-like> L9: OPENROUTER_MODEL_PREF=<redacted:35 token-like> L12: JWT_SECRET=<redacted:28 token-like> L14: STORAGE_DIR=<redacted:26 token-like> L18: DATABASE_URL=<redacted:30 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

server/.envView on unpkg · L5

server/public/assets/ort.min-faca3c2b.jsView file

4* Licensed under the MIT License. L5: */var vd=Object.create,Pn=Object.defineProperty,_d=Object.getOwnPropertyDescriptor,Od=Object.getOwnPropertyNames,Id=Object.getPrototypeOf,Sd=Object.prototype.hasOwnProperty,L=(e,r)... L6: precision highp float;

High

Eval

Package source references dynamic code evaluation.

server/public/assets/ort.min-faca3c2b.jsView on unpkg · L4

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

server/public/assets/ort.min-faca3c2b.jsView on unpkg

collector/middleware/verifyIntegrity.jsView file

1const { CommunicationKey } = require("../utils/comKey"); L2: const RuntimeSettings = require("../utils/runtimeSettings");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

collector/middleware/verifyIntegrity.jsView on unpkg · L1

server/utils/agents/aibitat/plugins/web-browsing.jsView file

40parameters: { L41: $schema: "http://json-schema.org/draft-07/schema#", L42: type: "object", ... L157: _serpApi: async function (query) { L158: if (!process.env.AGENT_SERPAPI_API_KEY) { L159: this.super.introspect( ... L173: L174: const params = new URLSearchParams({ L175: engine: engine, ... L185: .then((res) => { L186: if (res.ok) return res.json(); L187: throw new Error(

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

server/utils/agents/aibitat/plugins/web-browsing.jsView on unpkg · L40

server/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = totem-llm@0.15.0 matchedIdentity = npm:dG90ZW0tbGxt:0.15.0 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/index.jsView on unpkg

server/endpoints/system.jsView file

412patternName = generic_password severity = medium line = 412 matchedText = console....or);

Medium

Secret Pattern

Hardcoded password in server/endpoints/system.js

server/endpoints/system.jsView on unpkg · L412

Source & flagged code

9 flagged

package.jsonView file

Lines 39-79json

39 "setup": "cd server && yarn && cd ../collector && yarn && cd ../frontend && yarn && cd .. && yarn setup:envs && yarn prisma:setup && echo \"Please run yarn dev:server, yarn dev:collector, and yarn dev:frontend in separate terminal tabs.\"",

40 "setup:envs": "node scripts/setup-envs.mjs",

41 "dev:server": "cd server && yarn dev",

42 "dev:collector": "cd collector && yarn dev",

43 "dev:frontend": "cd frontend && yarn dev",

44 "dev:all": "npx concurrently \"yarn dev:server\" \"yarn dev:frontend\" \"yarn dev:collector\"",

45 "prisma:generate": "cd server && npx prisma generate",

46 "prisma:migrate": "cd server && npx prisma migrate dev --name init",

47 "prisma:seed": "cd server && npx prisma db seed",

48 "prisma:setup": "yarn prisma:generate && yarn prisma:migrate && yarn prisma:seed",

49 "prisma:reset": "node -e \"const{writeFileSync,existsSync}=require('fs');const p='server/storage/anythingllm.db';if(existsSync(p)){writeFileSync(p,'');console.log('Database cleared.')}\" && yarn prisma:migrate",

50 "prod:server": "cd server && yarn start",

51 "prod:frontend": "cd frontend && yarn build",

52 "generate:cloudformation": "node cloud-deployments/aws/cloudformation/generate.mjs",

53 "generate::gcp_deployment": "node cloud-deployments/gcp/deployment/generate.mjs",

54 "translations:verify": "cd frontend/src/locales && node verifyTranslations.mjs",

55 "translations:normalize": "cd frontend/src/locales && node normalizeEn.mjs && cd ../../.. && cd frontend && yarn lint && cd .. && yarn translations:verify",

56 "translations:prune": "cd frontend/src/locales && node findUnusedTranslations.mjs --delete && cd ../../../ && yarn translations:normalize",

57 "translations:create": "cd extras/translator && node index.mjs --all && cd ../../frontend && yarn lint && cd ../..",

58 "prepublishOnly": "node scripts/build-frontend.mjs",

59 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L59

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L59

60 "test:install": "node scripts/test-install.mjs"

61 },

62 "private": false,

63 "devDependencies": {

64 "@babel/core": "^8.0.1",

65 "@babel/preset-env": "^8.0.2",

66 "@commitlint/cli": "^21.2.1",

67 "@commitlint/config-conventional": "^21.2.0",

68 "@langchain/textsplitters": "^1.0.1",

69 "babel-jest": "^30.4.1",

70 "concurrently": "^9.1.2",

71 "dotenv": "^17.4.2",

72 "fix-path": "^5.0.0",

73 "jest": "^29.7.0",

74 "jsonwebtoken": "^9.0.3",

75 "lodash": "^4.18.1",

76 "pg": "^8.22.0",

77 "slugify": "^1.6.9",

78 "standard-version": "^9.5.0",

79 "uuid": "^14.0.1"

server/.envView file

Lines 1-19text

1# Auto-dump ENV from system call on 22:15:04 GMT-0400 (Eastern Daylight Time)

2LLM_PROVIDER='openrouter'

3OLLAMA_BASE_PATH='http://127.0.0.1:11434'

4OLLAMA_MODEL_PREF='qwen3.5:2b'

5OLLAMA_MODEL_TOKEN_LIMIT='4096'

6OLLAMA_AUTH_TOKEN='your-ollama-auth-token-here (optional, only for ollama running behind auth - Bearer token)'

7VECTOR_DB='lancedb'

8OPENROUTER_API_KEY='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'

9OPENROUTER_MODEL_PREF='nvidia/nemotron-3-nano-30b-a3b:free'

10OPENROUTER_TIMEOUT_MS='3000'

11WHISPER_PROVIDER='local'

12JWT_SECRET='my-random-string-for-seeding'

server/public/assets/ort.min-faca3c2b.jsView file

4* Licensed under the MIT License. L5: */var vd=Object.create,Pn=Object.defineProperty,_d=Object.getOwnPropertyDescriptor,Od=Object.getOwnPropertyNames,Id=Object.getPrototypeOf,Sd=Object.prototype.hasOwnProperty,L=(e,r)... L6: precision highp float;

High

Eval

Package source references dynamic code evaluation.

server/public/assets/ort.min-faca3c2b.jsView on unpkg · L4

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

server/public/assets/ort.min-faca3c2b.jsView on unpkg

collector/middleware/verifyIntegrity.jsView file

Lines 1-21javascript

1const { CommunicationKey } = require("../utils/comKey");

2const RuntimeSettings = require("../utils/runtimeSettings");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

collector/middleware/verifyIntegrity.jsView on unpkg · L1

server/utils/agents/aibitat/plugins/web-browsing.jsView file

Lines 20-60javascript

20 .toString()

21 .replace(/\B(?=(\d{3})+(?!\d))/g, ","),

22 description:

23 "Search the internet for real-time information. Look online for current news, recent updates, latest changes, or any information not available locally. Browse the web to find answers about current events, prices, weather, or live data."

server/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = totem-llm@0.15.0 matchedIdentity = npm:dG90ZW0tbGxt:0.15.0 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/index.jsView on unpkg

server/endpoints/system.jsView file

Lines 392-432javascript

392 );

393

394 app.post(

395 "/system/reset-password",

396 [isMultiUserSetup],

397 async (request, response) => {

398 try