Malicious code in llm-interceptor (npm)
The npm package llm-interceptor contained malicious code in its postinstall script that exfiltrated AI coding conversations and installed persistence mechanisms. The package registered MCP server entries, installed Claude hooks, and on Windows created scheduled tasks to auto-start a proxy that sent user prompts, generated code, and assistant responses to an attacker-controlled Cloudflare tunnel endpoint.
- Disclosed
- Last updated
- Blast radius
- Developers using llm-interceptor npm package; AI coding conversations, prompts, generated code, and assistant answers exfiltrated; Windows systems subject to persistent scheduled task installation.
- Ecosystems
- Attack vectors
- Affected entities
- llm-interceptornpm package with malicious postinstall script
The npm package llm-interceptor was found to contain malicious code executed during installation via a postinstall script (dist/cli/setup.js). Upon installation, the script registered an MCP server entry in ~/.cursor/mcp.json, invoked claude mcp add llm-interceptor, and installed a Claude Code SessionEnd hook in ~/.claude/settings.json.
On Windows systems, the malicious code created a per-user scheduled task (schtasks /Create /SC ONLOGON) to auto-start the proxy at every logon, establishing persistence. The package's defaults.json hardcoded an egress destination to https://processes-books-delight-pre.trycloudflare.com/v1/tasks (an anonymous Cloudflare Quick Tunnel) with a static bearer token friend-token and tenant label friend-laptop.
Once running, the package's ClaudeTailer, CodexTailer, and CursorTailer components recursively read AI coding conversation files from ~/.claude/projects/**/*.jsonl and ~/.codex/sessions/**/*.jsonl, including prompts, generated code, and assistant responses, and exfiltrated them via POST requests to the attacker-controlled endpoint. The hook.js component additionally sent raw user and assistant text to /v1/turns for server-side processing.
The package included a self-update.js mechanism that polled /v1/config on the same endpoint and, when a different bundleVersion was returned, spawned a detached npm install -g llm-interceptor@ command, giving the attacker a live push channel to update the installed package to any tag on demand.
Indicators of compromise
- Packages
- llm-interceptor
- Domains
- processes-books-delight-pre.trycloudflare.com
Remediation
- Immediately uninstall the llm-interceptor npm package from all systems
- Remove MCP server entries from ~/.cursor/mcp.json
- Remove Claude Code SessionEnd hooks from ~/.claude/settings.json
- On Windows, delete the auto-start scheduled task created by the malicious postinstall script
- Review and revoke any credentials or sensitive information that may have been exposed in AI coding conversations
- Audit ~/.claude/projects and ~/.codex/sessions directories for unauthorized access
- Monitor network traffic for connections to processes-books-delight-pre.trycloudflare.com and related attacker infrastructure
- Use npm audit to check for any remaining malicious dependencies
Sources
- GitHub Advisory GHSA-6wxr-274h-wx32 · GitHub Advisory Database
Cite this entry
"Malicious code in llm-interceptor (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-llm-interceptor-npm-1epvxq
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in a.poltoradnev-package-a
The npm package a.poltoradnev-package-a contains malware that grants full system compromise to attackers. Any computer with this package installed should be considered fully compromised and all secrets and keys rotated immediately from a different machine.
npmCompromised package - containedcritical
Malware in @junofficial/baileys
The npm package @junofficial/baileys contained malware that fully compromised any system with the package installed or running. The malicious package has been identified and removed from distribution.
npmCompromised package - containedcritical
Malware in userbotjs
The npm package userbotjs contained malware that could fully compromise any system on which it was installed. The advisory recommends treating affected systems as fully compromised and rotating all secrets and keys from a different computer.
npmCompromised package - containedcritical
Malware in agent-bot-api
Malware was discovered in the npm package agent-bot-api. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmCompromised package