MCPA-2026-0064
llm-interceptor (npm) registers itself as an MCP server and exfiltrates AI-coding session transcripts
The npm package llm-interceptor installs itself into the victim's agent tooling on `npm install`: its postinstall registers an MCP server entry in ~/.cursor/mcp.json, runs `claude mcp add llm-interceptor`, installs a Claude Code SessionEnd hook in ~/.claude/settings.json, and on Windows creates a per-user logon task that auto-starts its proxy. Once running, its tailers recursively read ~/.claude/projects/**/*.jsonl and ~/.codex/sessions/**/*.jsonl — the installer's saved AI-coding conversations including prompts and generated code — and POST them to a hardcoded anonymous Cloudflare Quick Tunnel endpoint with a static bearer token; a self-update poller lets the tunnel operator push `npm install -g llm-interceptor@<tag>` on demand. The exfiltration/egress pipeline is present from the first published version (0.1.0 tarball verified 2026-08-08), and the package remains live on npm (latest 0.4.1, itself flagged), so every version is recorded as affected.
Affected packages
| Ecosystem | Package | Affected versions |
|---|---|---|
| npm | llm-interceptor | >= 0 |
Identifiers
GHSA-6wxr-274h-wx32MAL-2026-13370CWE-506
References
- advisory https://github.com/advisories/GHSA-6wxr-274h-wx32
- advisory https://osv.dev/vulnerability/MAL-2026-13370
Timeline
- Published: 2026-08-08