Malicious code in llm-interceptor (npm)
The llm-interceptor npm package contains malicious code that installs persistent data collection and remote code execution capabilities on the host system. Upon installation, it runs a setup script that establishes long-lived data exfiltration to a hardcoded Cloudflare Quick Tunnel URL without user consent. It collects AI assistant transcripts and system metadata, sending them periodically to a remote server. The package installs multiple persistence mechanisms on Windows, including scheduled tasks, registry run keys, and startup shortcuts, ensuring the collector restarts after reboots. It also supports remote arbitrary code execution by polling for updates and installing new package versions silently. Declining consent prompts does not disable these malicious functions or remove persistence.
AI Analysis
Technical Summary
The llm-interceptor npm package versions 0.3.0, 0.3.1, 0.3.3, 0.3.4, 0.3.8, 0.4.0, and 0.4.1 contain malicious post-installation behavior. The postinstall.js script runs runSetup() unconditionally, which integrates the package into the installer's AI tooling and sets up persistent data collection infrastructure before any consent dialog is shown. A baked defaults.json configures egressUrl to a hardcoded ephemeral Cloudflare Quick Tunnel endpoint. Components named CursorTailer, ClaudeTailer, and CodexTailer collect and parse AI assistant transcripts from user directories and send this data to the remote server. A heartbeat report with device and user identifiers is sent every 15 minutes regardless of consent. The package installs a hidden PowerShell watchdog and three redundant Windows persistence mechanisms (Scheduled Task with ONLOGON trigger, registry Run key, and Startup folder shortcut) to maintain persistence across reboots. The maybeSelfUpdate() function polls the remote server for a newer bundleVersion and can execute arbitrary npm install commands to update itself, enabling remote code execution. Declining the post-install consent prompt does not remove the malicious integrations or persistence mechanisms.
Potential Impact
This malicious package exfiltrates sensitive user data including AI assistant transcripts and system identifiers without user consent. It establishes persistent backdoors on Windows systems that survive reboots and user attempts to decline consent. The remote operator can execute arbitrary code on the infected host at any time by triggering package updates, posing a severe risk of system compromise and data leakage.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately uninstall the llm-interceptor package if present and remove all persistence mechanisms manually, including scheduled tasks, registry run keys, and startup shortcuts related to llm-interceptor. Declining consent prompts does not disable the malicious behavior, so manual cleanup is required. Monitor for network connections to the specified Cloudflare Quick Tunnel domain and block it if possible. Check vendor advisories or trusted security sources for updates on remediation.
Malicious code in llm-interceptor (npm)
Description
The llm-interceptor npm package contains malicious code that installs persistent data collection and remote code execution capabilities on the host system. Upon installation, it runs a setup script that establishes long-lived data exfiltration to a hardcoded Cloudflare Quick Tunnel URL without user consent. It collects AI assistant transcripts and system metadata, sending them periodically to a remote server. The package installs multiple persistence mechanisms on Windows, including scheduled tasks, registry run keys, and startup shortcuts, ensuring the collector restarts after reboots. It also supports remote arbitrary code execution by polling for updates and installing new package versions silently. Declining consent prompts does not disable these malicious functions or remove persistence.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The llm-interceptor npm package versions 0.3.0, 0.3.1, 0.3.3, 0.3.4, 0.3.8, 0.4.0, and 0.4.1 contain malicious post-installation behavior. The postinstall.js script runs runSetup() unconditionally, which integrates the package into the installer's AI tooling and sets up persistent data collection infrastructure before any consent dialog is shown. A baked defaults.json configures egressUrl to a hardcoded ephemeral Cloudflare Quick Tunnel endpoint. Components named CursorTailer, ClaudeTailer, and CodexTailer collect and parse AI assistant transcripts from user directories and send this data to the remote server. A heartbeat report with device and user identifiers is sent every 15 minutes regardless of consent. The package installs a hidden PowerShell watchdog and three redundant Windows persistence mechanisms (Scheduled Task with ONLOGON trigger, registry Run key, and Startup folder shortcut) to maintain persistence across reboots. The maybeSelfUpdate() function polls the remote server for a newer bundleVersion and can execute arbitrary npm install commands to update itself, enabling remote code execution. Declining the post-install consent prompt does not remove the malicious integrations or persistence mechanisms.
Potential Impact
This malicious package exfiltrates sensitive user data including AI assistant transcripts and system identifiers without user consent. It establishes persistent backdoors on Windows systems that survive reboots and user attempts to decline consent. The remote operator can execute arbitrary code on the infected host at any time by triggering package updates, posing a severe risk of system compromise and data leakage.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately uninstall the llm-interceptor package if present and remove all persistence mechanisms manually, including scheduled tasks, registry run keys, and startup shortcuts related to llm-interceptor. Declining consent prompts does not disable the malicious behavior, so manual cleanup is required. Monitor for network connections to the specified Cloudflare Quick Tunnel domain and block it if possible. Check vendor advisories or trusted security sources for updates on remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13370
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a74cf8ebf8831d5391aea31
Added to database: 08/06/2026, 18:16:46 UTC
Last enriched: 08/06/2026, 18:39:26 UTC
Last updated: 08/06/2026, 18:39:26 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.