registry / Credential exfiltration / totem-llm / 0.16.1

totem-llm@0.16.1

Totem LLM – Your Private AI. Run a self-hosted AI assistant locally on Linux, macOS, or Windows.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The shipped credential-bearing environment file and remote default are a real security risk. The inspected lifecycle and runtime code does not establish malicious intent or a concrete malware chain.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Run totem-llm and use the configured LLM service.

Impact

User prompts may be sent to the remote provider, and the shipped API credential is exposed to package recipients.

Mechanism

Loads a packaged environment file and initializes a remote OpenRouter client.

AI rationale

The shipped credential-bearing environment file and remote default are a real security risk. The inspected lifecycle and runtime code does not establish malicious intent or a concrete malware chain.

Evidence

server/.envserver/index.jsserver/utils/AiProviders/openRouter/index.jsscripts/postinstall.mjsserver/package.jsoncollector/package.json

Network endpoints1

openrouter.ai/api/v1

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Critical Vulnerability with medium false-positive risk.

Evidence for warning

A packaged environment file is labelled as an automatic environment dump and selects OpenRouter.
The packaged environment file contains an OpenRouter API-key entry; the value is omitted.
The server loads its local environment file and passes the OpenRouter key to a remote API client.

Evidence against

No runtime dependency on totem-llm was found in the root, server, or collector manifests.
The install hook installs dependencies only into bundled server and collector directories; no broad host or agent-control mutation was found.
Remote search calls are user-invoked features using configured provider credentials, not credential harvesting.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStrings

Source & flagged code

13 flagged

package.jsonView file

Lines 39-79json

39 "setup": "cd server && yarn && cd ../collector && yarn && cd ../frontend && yarn && cd .. && yarn setup:envs && yarn prisma:setup && echo \"Please run yarn dev:server, yarn dev:collector, and yarn dev:frontend in separate terminal tabs.\"",

40 "setup:envs": "node scripts/setup-envs.mjs",

41 "dev:server": "cd server && yarn dev",

42 "dev:collector": "cd collector && yarn dev",

43 "dev:frontend": "cd frontend && yarn dev",

44 "dev:all": "npx concurrently \"yarn dev:server\" \"yarn dev:frontend\" \"yarn dev:collector\"",

45 "prisma:generate": "cd server && npx prisma generate",

46 "prisma:migrate": "cd server && npx prisma migrate dev --name init",

47 "prisma:seed": "cd server && npx prisma db seed",

48 "prisma:setup": "yarn prisma:generate && yarn prisma:migrate && yarn prisma:seed",

49 "prisma:reset": "node -e \"const{writeFileSync,existsSync}=require('fs');const p='server/storage/anythingllm.db';if(existsSync(p)){writeFileSync(p,'');console.log('Database cleared.')}\" && yarn prisma:migrate",

50 "prod:server": "cd server && yarn start",

51 "prod:frontend": "cd frontend && yarn build",

52 "generate:cloudformation": "node cloud-deployments/aws/cloudformation/generate.mjs",

53 "generate::gcp_deployment": "node cloud-deployments/gcp/deployment/generate.mjs",

54 "translations:verify": "cd frontend/src/locales && node verifyTranslations.mjs",

55 "translations:normalize": "cd frontend/src/locales && node normalizeEn.mjs && cd ../../.. && cd frontend && yarn lint && cd .. && yarn translations:verify",

56 "translations:prune": "cd frontend/src/locales && node findUnusedTranslations.mjs --delete && cd ../../../ && yarn translations:normalize",

57 "translations:create": "cd extras/translator && node index.mjs --all && cd ../../frontend && yarn lint && cd ../..",

58 "prepublishOnly": "node scripts/build-frontend.mjs",

59 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L59

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L59

60 "test:install": "node scripts/test-install.mjs"

61 },

62 "private": false,

63 "devDependencies": {

64 "@babel/core": "^8.0.1",

65 "@babel/preset-env": "^8.0.2",

66 "@commitlint/cli": "^21.2.1",

67 "@commitlint/config-conventional": "^21.2.0",

68 "@langchain/textsplitters": "^1.0.1",

69 "babel-jest": "^30.4.1",

70 "concurrently": "^9.1.2",

71 "dotenv": "^17.4.2",

72 "fix-path": "^5.0.0",

73 "jest": "^29.7.0",

74 "jsonwebtoken": "^9.0.3",

75 "lodash": "^4.18.1",

76 "pg": "^8.22.0",

77 "slugify": "^1.6.9",

78 "standard-version": "^9.5.0",

79 "uuid": "^14.0.1"

server/.envView file

Lines 1-19text

1# Auto-dump ENV from system call on 22:15:04 GMT-0400 (Eastern Daylight Time)

2LLM_PROVIDER='openrouter'

3OLLAMA_BASE_PATH='http://127.0.0.1:11434'

4OLLAMA_MODEL_PREF='qwen3.5:2b'

5OLLAMA_MODEL_TOKEN_LIMIT='4096'

6OLLAMA_AUTH_TOKEN='your-ollama-auth-token-here (optional, only for ollama running behind auth - Bearer token)'

7VECTOR_DB='lancedb'

8OPENROUTER_API_KEY='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'

9OPENROUTER_MODEL_PREF='nvidia/nemotron-3-nano-30b-a3b:free'

10OPENROUTER_TIMEOUT_MS='3000'

11WHISPER_PROVIDER='local'

12JWT_SECRET='my-random-string-for-seeding'

server/public/assets/ort.min-faca3c2b.jsView file

4* Licensed under the MIT License. L5: */var vd=Object.create,Pn=Object.defineProperty,_d=Object.getOwnPropertyDescriptor,Od=Object.getOwnPropertyNames,Id=Object.getPrototypeOf,Sd=Object.prototype.hasOwnProperty,L=(e,r)... L6: precision highp float;

High

Eval

Package source references dynamic code evaluation.

server/public/assets/ort.min-faca3c2b.jsView on unpkg · L4

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

server/public/assets/ort.min-faca3c2b.jsView on unpkg

collector/middleware/verifyIntegrity.jsView file

1const { CommunicationKey } = require("../utils/comKey"); L2: const RuntimeSettings = require("../utils/runtimeSettings");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

collector/middleware/verifyIntegrity.jsView on unpkg · L1

server/utils/agents/aibitat/plugins/web-browsing.jsView file

40parameters: { L41: $schema: "http://json-schema.org/draft-07/schema#", L42: type: "object", ... L157: _serpApi: async function (query) { L158: if (!process.env.AGENT_SERPAPI_API_KEY) { L159: this.super.introspect( ... L173: L174: const params = new URLSearchParams({ L175: engine: engine, ... L185: .then((res) => { L186: if (res.ok) return res.json(); L187: throw new Error(

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

server/utils/agents/aibitat/plugins/web-browsing.jsView on unpkg · L40

collector/index.jsView file

•matchType = normalized_sha256 matchedPackage = totem-llm@0.15.1 matchedPath = collector/index.js matchedIdentity = npm:dG90ZW0tbGxt:0.15.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

collector/index.jsView on unpkg

server/endpoints/system.jsView file

Lines 391-431javascript

391 );

392

393 app.post(

394 "/system/reset-password",

395 [isMultiUserSetup],

396 async (request, response) => {

397 try

server/endpoints/utils.jsView file

•matchType = normalized_sha256 matchedPackage = totem-llm@0.15.1 matchedPath = server/endpoints/utils.js matchedIdentity = npm:dG90ZW0tbGxt:0.15.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

server/endpoints/utils.jsView on unpkg

server/swagger/utils.jsView file

•matchType = normalized_sha256 matchedPackage = totem-llm@0.15.1 matchedPath = server/swagger/utils.js matchedIdentity = npm:dG90ZW0tbGxt:0.15.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

server/swagger/utils.jsView on unpkg

server/utils/AiProviders/apipie/index.jsView file

•matchType = normalized_sha256 matchedPackage = totem-llm@0.15.1 matchedPath = [redacted].js matchedIdentity = npm:dG90ZW0tbGxt:0.15.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

server/utils/AiProviders/apipie/index.jsView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

server/.envView file

5patternName = blocked_file severity = critical matchedText = server/.env redactedSecretContext = secretLikeLines = 7 L5: OLLAMA_MODEL_TOKEN_LIMIT=<redacted:4 value> L6: OLLAMA_AUTH_TOKEN=<redacted:90 token-like> L8: OPENROUTER_API_KEY=<redacted:73 token-like> L9: OPENROUTER_MODEL_PREF=<redacted:35 token-like> L12: JWT_SECRET=<redacted:28 token-like> L14: STORAGE_DIR=<redacted:26 token-like> L18: DATABASE_URL=<redacted:30 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

Findings

2 Critical8 High7 Medium6 Low

CriticalCritical Secretserver/.env

CriticalCredential Exfiltrationserver/utils/agents/aibitat/plugins/web-browsing.js

HighInstall Time Lifecycle Scriptspackage.json

HighEvalserver/public/assets/ort.min-faca3c2b.js

HighSemantic Analysis Limitedserver/public/assets/ort.min-faca3c2b.js

HighKnown Malware Source Similaritycollector/index.js

HighKnown Malware Source Similarityserver/endpoints/system.js

HighKnown Malware Source Similarityserver/endpoints/utils.js

HighKnown Malware Source Similarityserver/swagger/utils.js

HighKnown Malware Source Similarityserver/utils/AiProviders/apipie/index.js

Medium

Affected versions and remediation

This report applies to totem-llm@0.16.1.

See all versions of totem-llm for other recorded verdicts.

Review the evidence and your use of totem-llm@0.16.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-29 09:05:49.608Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.