llm-interceptor

{"schema_version":"1.7.4","id":"MAL-2026-13370","published":"2026-08-05T18:29:35Z","modified":"2026-08-06T13:11:09.616554246Z","summary":"Malicious code in llm-interceptor (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (46cc7f305d00b175d42babae0198faea6951f846bcdeda2e3d6754fd9ceba2d7)\nOn npm install, postinstall.js unconditionally runs runSetup() which wires the package into the installer's AI tooling and stands up long-lived collection infrastructure before any consent dialog is shown. A baked defaults.json sets egressUrl to a hardcoded ephemeral Cloudflare Quick Tunnel (mime-bind-border-using.trycloudflare.com). CursorTailer, ClaudeTailer, and CodexTailer walk ~/.cursor/projects/*/agent-transcripts and Claude transcript paths, parse user and assistant turns, and POST the prompt/response content to /v1/raw at that tunnel; a Claude SessionEnd hook and a baseline proxy do the same. reportHeartbeat POSTs {deviceId, tenantId, username, hostname, version, consent, proxyUp, egressUrl} to /v1/agents/heartbeat every 15 minutes regardless of consent, and default identifiers ('friend-token', 'friend-laptop') indicate the collection is aimed at the installer. registerAutostart drops a hidden PowerShell watchdog under ~/.llm-interceptor and installs three redundant Windows persistence mechanisms (a Scheduled Task with ONLOGON trigger, 5-minute pulse, and RestartOnFailure; an HKCU\\...\\Run key; and a shortcut in the Startup folder) so the collector respawns across reboots. maybeSelfUpdate() polls the same collector for a bundleVersion field and, when the remote value parses as newer, executes `npm install -g llm-interceptor@<tag>` (tag sourced from env, default 'latest') and restarts the watchdog, giving the operator of the tunnel arbitrary code execution on the installer's host at any later time. Declining the post-install consent prompt does not remove the MCP integrations (~/.cursor/mcp.json, `claude mcp add`, ~/.claude/settings.json SessionEnd hook), autostart entries, or heartbeat.\n","affected":[{"package":{"name":"llm-interceptor","ecosystem":"npm"},"versions":["0.3.0","0.3.1","0.3.4","0.3.3","0.4.0","0.4.1","0.3.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"defaults.json","sha256":"4a3d53a22097d58dddc77b95e009768ede597467999ae954009daa50cf14d35d","tlsh":"e8d02b6b92854133497184d0a4e7204b6c610f0e42b60c6f73b350260751e833a03304"},{"path":"dist/cli/setup.js","sha256":"ecafeee5db1ae1db9634b680d7cac822dac4ec5dc149f31007218759249860ed","tlsh":"9b32509a18fb863684f760b51b5f001217a9e9031208fcb4f39dc7a05f5d659da51bdc"},{"path":"dist/collect/hook.js","sha256":"e12e5c5dd7438582038003680f7b53f5a261a271da018715cf664c241a8fa69d","tlsh":"abe175a708ff2c320263749ddb6f9026a36a9247350cdc50fb8d93949f0c55de961bd8"},{"path":"dist/telemetry.js","sha256":"37af87cccf1d6858c1b3d2fb0a12bb7d69f710d6a303b0bf2c280dc7a6efb867","tlsh":"9341a48b08bb2c76506b596dfb2f90119331e6c77a019864fa8c136c7fc942c5ab1fd8"},{"path":"dist/self-update.js","sha256":"7f73a4727d7608a9f3f1031f54f98d3857941e1941462e8973b6c396c274cf0f","tlsh":"4b5134ea1cfb9f320977655c422e5026137a83073618d468fbaed7147f4b51cd6227e8"}],"package_integrity":[{"filename":"llm-interceptor-0.3.0.tgz","hashes":{"sha1":"e27655b22ea80ce940c1c62514f19bd161131991","sha512_sri":"sha512-WbMGbmQ8oFcYR0xnfltZV8CU9he3gbtOvtCcLCqBG3E9QV3PwBG4kgH5jFprnXQniHo+ZcpPACGYDmQy8E2ieg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/llm-interceptor/v/0.3.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/llm-interceptor/v/0.3.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/llm-interceptor/v/0.3.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/llm-interceptor/v/0.3.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/llm-interceptor/v/0.4.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/llm-interceptor/v/0.4.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/llm-interceptor/v/0.3.8"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015882","import_time":"2026-08-05T19:04:56.981278574Z","modified_time":"2026-08-05T18:29:42Z","sha256":"16438555e4d831a42853aaa7d0f899a4d4bbfb9cb3bba55e0a02f01e7fe134cc","source":"amazon-inspector","versions":["0.3.0"]},{"id":"IN-MAL-2026-015883","import_time":"2026-08-05T19:04:57.039334282Z","modified_time":"2026-08-05T18:29:50Z","sha256":"7b9bc3c5aa2605a5333fb7b5bf185f5b1c12597b5f6b494e73981ad7f2768a38","source":"amazon-inspector","versions":["0.3.1"]},{"id":"IN-MAL-2026-015881","import_time":"2026-08-05T19:04:56.908407781Z","modified_time":"2026-08-05T18:29:35Z","sha256":"8082d7a19c6789008fa42546002af8cdfdb03ad15197441dcc1fdd6afe0fdd32","source":"amazon-inspector","versions":["0.3.4"]},{"id":"IN-MAL-2026-015884","import_time":"2026-08-05T19:04:57.093350913Z","modified_time":"2026-08-05T18:30:02Z","sha256":"ee7ec72017879a5158404af8dec1c3ca872dd8ae76430b0deb584327ef858ff7","source":"amazon-inspector","versions":["0.3.3"]},{"id":"IN-MAL-2026-016094","import_time":"2026-08-06T13:08:48.689244917Z","modified_time":"2026-08-06T12:30:28Z","sha256":"09851a3bc35c923b501ed144d384cdfe005fd6c0502a30d1c5a132a9517b7fa6","source":"amazon-inspector","versions":["0.4.0"]},{"id":"IN-MAL-2026-016092","import_time":"2026-08-06T13:08:48.487807204Z","modified_time":"2026-08-06T12:30:09Z","sha256":"46cc7f305d00b175d42babae0198faea6951f846bcdeda2e3d6754fd9ceba2d7","source":"amazon-inspector","versions":["0.4.1"]},{"id":"IN-MAL-2026-016091","import_time":"2026-08-06T13:08:48.338701062Z","modified_time":"2026-08-06T12:30:02Z","sha256":"bf461deee8097a09a6fd780c8ddd469024e6499a4440fd8346c56fcc678abf13","source":"amazon-inspector","versions":["0.3.8"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}