MAL-2026-13370

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/llm-interceptor/MAL-2026-13370.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13370
Published
2026-08-05T18:29:35Z
Modified
2026-08-06T13:34:43.467350965Z
Summary
Malicious code in llm-interceptor (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (46cc7f305d00b175d42babae0198faea6951f846bcdeda2e3d6754fd9ceba2d7)

On npm install, postinstall.js unconditionally runs runSetup() which wires the package into the installer's AI tooling and stands up long-lived collection infrastructure before any consent dialog is shown. A baked defaults.json sets egressUrl to a hardcoded ephemeral Cloudflare Quick Tunnel (mime-bind-border-using.trycloudflare.com). CursorTailer, ClaudeTailer, and CodexTailer walk ~/.cursor/projects/*/agent-transcripts and Claude transcript paths, parse user and assistant turns, and POST the prompt/response content to /v1/raw at that tunnel; a Claude SessionEnd hook and a baseline proxy do the same. reportHeartbeat POSTs {deviceId, tenantId, username, hostname, version, consent, proxyUp, egressUrl} to /v1/agents/heartbeat every 15 minutes regardless of consent, and default identifiers ('friend-token', 'friend-laptop') indicate the collection is aimed at the installer. registerAutostart drops a hidden PowerShell watchdog under ~/.llm-interceptor and installs three redundant Windows persistence mechanisms (a Scheduled Task with ONLOGON trigger, 5-minute pulse, and RestartOnFailure; an HKCU...\Run key; and a shortcut in the Startup folder) so the collector respawns across reboots. maybeSelfUpdate() polls the same collector for a bundleVersion field and, when the remote value parses as newer, executes npm install -g llm-interceptor@<tag> (tag sourced from env, default 'latest') and restarts the watchdog, giving the operator of the tunnel arbitrary code execution on the installer's host at any later time. Declining the post-install consent prompt does not remove the MCP integrations (~/.cursor/mcp.json, claude mcp add, ~/.claude/settings.json SessionEnd hook), autostart entries, or heartbeat.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T19:04:56.981278574Z",
            "modified_time": "2026-08-05T18:29:42Z",
            "sha256": "16438555e4d831a42853aaa7d0f899a4d4bbfb9cb3bba55e0a02f01e7fe134cc",
            "source": "amazon-inspector",
            "versions": [
                "0.3.0"
            ],
            "id": "IN-MAL-2026-015882"
        },
        {
            "id": "IN-MAL-2026-015883",
            "modified_time": "2026-08-05T18:29:50Z",
            "sha256": "7b9bc3c5aa2605a5333fb7b5bf185f5b1c12597b5f6b494e73981ad7f2768a38",
            "import_time": "2026-08-05T19:04:57.039334282Z",
            "source": "amazon-inspector",
            "versions": [
                "0.3.1"
            ]
        },
        {
            "versions": [
                "0.3.4"
            ],
            "modified_time": "2026-08-05T18:29:35Z",
            "id": "IN-MAL-2026-015881",
            "import_time": "2026-08-05T19:04:56.908407781Z",
            "sha256": "8082d7a19c6789008fa42546002af8cdfdb03ad15197441dcc1fdd6afe0fdd32",
            "source": "amazon-inspector"
        },
        {
            "sha256": "ee7ec72017879a5158404af8dec1c3ca872dd8ae76430b0deb584327ef858ff7",
            "modified_time": "2026-08-05T18:30:02Z",
            "versions": [
                "0.3.3"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-015884",
            "import_time": "2026-08-05T19:04:57.093350913Z"
        },
        {
            "import_time": "2026-08-06T13:08:48.689244917Z",
            "modified_time": "2026-08-06T12:30:28Z",
            "sha256": "09851a3bc35c923b501ed144d384cdfe005fd6c0502a30d1c5a132a9517b7fa6",
            "source": "amazon-inspector",
            "versions": [
                "0.4.0"
            ],
            "id": "IN-MAL-2026-016094"
        },
        {
            "import_time": "2026-08-06T13:08:48.487807204Z",
            "modified_time": "2026-08-06T12:30:09Z",
            "sha256": "46cc7f305d00b175d42babae0198faea6951f846bcdeda2e3d6754fd9ceba2d7",
            "source": "amazon-inspector",
            "versions": [
                "0.4.1"
            ],
            "id": "IN-MAL-2026-016092"
        },
        {
            "versions": [
                "0.3.8"
            ],
            "modified_time": "2026-08-06T12:30:02Z",
            "id": "IN-MAL-2026-016091",
            "import_time": "2026-08-06T13:08:48.338701062Z",
            "sha256": "bf461deee8097a09a6fd780c8ddd469024e6499a4440fd8346c56fcc678abf13",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / llm-interceptor

Package

Name
llm-interceptor
View open source insights on deps.dev
Purl
pkg:npm/llm-interceptor

Affected ranges

Affected versions

0.*
0.3.0
0.3.1
0.3.3
0.3.4
0.3.8
0.4.0
0.4.1

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "tlsh": "e8d02b6b92854133497184d0a4e7204b6c610f0e42b60c6f73b350260751e833a03304",
            "path": "defaults.json",
            "sha256": "4a3d53a22097d58dddc77b95e009768ede597467999ae954009daa50cf14d35d"
        },
        {
            "path": "dist/cli/setup.js",
            "tlsh": "9b32509a18fb863684f760b51b5f001217a9e9031208fcb4f39dc7a05f5d659da51bdc",
            "sha256": "ecafeee5db1ae1db9634b680d7cac822dac4ec5dc149f31007218759249860ed"
        },
        {
            "path": "dist/collect/hook.js",
            "tlsh": "abe175a708ff2c320263749ddb6f9026a36a9247350cdc50fb8d93949f0c55de961bd8",
            "sha256": "e12e5c5dd7438582038003680f7b53f5a261a271da018715cf664c241a8fa69d"
        },
        {
            "path": "dist/telemetry.js",
            "tlsh": "9341a48b08bb2c76506b596dfb2f90119331e6c77a019864fa8c136c7fc942c5ab1fd8",
            "sha256": "37af87cccf1d6858c1b3d2fb0a12bb7d69f710d6a303b0bf2c280dc7a6efb867"
        },
        {
            "path": "dist/self-update.js",
            "tlsh": "4b5134ea1cfb9f320977655c422e5026137a83073618d468fbaed7147f4b51cd6227e8",
            "sha256": "7f73a4727d7608a9f3f1031f54f98d3857941e1941462e8973b6c396c274cf0f"
        }
    ],
    "package_integrity": [
        {
            "filename": "llm-interceptor-0.3.0.tgz",
            "hashes": {
                "sha1": "e27655b22ea80ce940c1c62514f19bd161131991",
                "sha512_sri": "sha512-WbMGbmQ8oFcYR0xnfltZV8CU9he3gbtOvtCcLCqBG3E9QV3PwBG4kgH5jFprnXQniHo+ZcpPACGYDmQy8E2ieg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/llm-interceptor/MAL-2026-13370.json"