Which versions of llm-interceptor are malicious?

The following npm versions of llm-interceptor are flagged malicious: 0.3.0, 0.3.1, 0.3.3, 0.3.4, 0.3.8, 0.4.0, 0.4.1. Treat any of these as compromised.

How do I remediate llm-interceptor if I installed it?

Remove llm-interceptor from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed llm-interceptor — how do I know if it already compromised me?

If llm-interceptor was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is llm-interceptor part of a known attack campaign?

Yes — llm-interceptor is associated with the IN-MAL-2026-015882, IN-MAL-2026-015883, IN-MAL-2026-015881, IN-MAL-2026-015884, IN-MAL-2026-016094, IN-MAL-2026-016092, IN-MAL-2026-016091 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find llm-interceptor across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for llm-interceptor (7 malicious versions).

Malicious package

llm-interceptornpm

Advisory published Aug 5, 2026Updated Aug 6, 2026

llm-interceptor is a confirmed malicious npm package (MAL-2026-13370) that executes malicious code on install (malicious versions 0.3.0, 0.3.1, 0.3.3…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in llm-interceptor (npm)

MAL-2026-13370

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall llm-interceptor

What this malware does

On npm install, postinstall.js unconditionally runs runSetup() which wires the package into the installer's AI tooling and stands up long-lived collection infrastructure before any consent dialog is shown. A baked defaults.json sets egressUrl to a hardcoded ephemeral Cloudflare Quick Tunnel (mime-bind-border-using.trycloudflare.com). CursorTailer, ClaudeTailer, and CodexTailer walk ~/.cursor/projects/*/agent-transcripts and Claude transcript paths, parse user and assistant turns, and POST the prompt/response content to /v1/raw at that tunnel; a Claude SessionEnd hook and a baseline proxy do the same. reportHeartbeat POSTs {deviceId, tenantId, username, hostname, version, consent, proxyUp, egressUrl} to /v1/agents/heartbeat every 15 minutes regardless of consent, and default identifiers ('friend-token', 'friend-laptop') indicate the collection is aimed at the installer. registerAutostart drops a hidden PowerShell watchdog under /.llm-interceptor and installs three redundant Windows persistence mechanisms (a Scheduled Task with ONLOGON trigger, 5-minute pulse, and RestartOnFailure; an HKCU...\Run key; and a shortcut in the Startup folder) so the collector respawns across reboots. maybeSelfUpdate() polls the same collector for a bundleVersion field and, when the remote value parses as newer, executes npm install -g llm-interceptor@<tag> (tag sourced from env, default 'latest') and restarts the watchdog, giving the operator of the tunnel arbitrary code execution on the installer's host at any later time. Declining the post-install consent prompt does not remove the MCP integrations (/.cursor/mcp.json, claude mcp add, ~/.claude/settings.json SessionEnd hook), autostart entries, or heartbeat.

Malicious versions

7 flagged

0.3.00.3.10.3.30.3.40.3.80.4.00.4.1

Indicators of compromise (SHA-256)

16438555e4d831a42853aaa7d0f899a4d4bbfb9cb3bba55e0a02f01e7fe134cc

7b9bc3c5aa2605a5333fb7b5bf185f5b1c12597b5f6b494e73981ad7f2768a38

8082d7a19c6789008fa42546002af8cdfdb03ad15197441dcc1fdd6afe0fdd32

ee7ec72017879a5158404af8dec1c3ca872dd8ae76430b0deb584327ef858ff7

09851a3bc35c923b501ed144d384cdfe005fd6c0502a30d1c5a132a9517b7fa6

46cc7f305d00b175d42babae0198faea6951f846bcdeda2e3d6754fd9ceba2d7

bf461deee8097a09a6fd780c8ddd469024e6499a4440fd8346c56fcc678abf13

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for llm-interceptor (7 malicious versions).
If you installed it — respond
Remove llm-interceptor from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If llm-interceptor was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. llm-interceptor on npm has been identified as a malicious package (versions 0.3.0, 0.3.1, 0.3.3, 0.3.4, 0.3.8, 0.4.0, 0.4.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-015882IN-MAL-2026-015883IN-MAL-2026-015881IN-MAL-2026-015884IN-MAL-2026-016094IN-MAL-2026-016092IN-MAL-2026-016091

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks llm-interceptor-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database