LLM proxy malware in npm and PyPI turns servers into relays

At a glance

What this is: Aikido details two malicious packages that installed an LLM proxy and remote access tooling on victim servers, turning them into covert relays for attacker-controlled AI traffic.

Why it matters: This matters because compromised runtime hosts can expose both infrastructure access and AI workflow data, creating a governance gap across secrets, SSH, and model request paths.

By the numbers:

• The binary contains 109 hardcoded model name strings used to build the /v1/models response.

👉 Read Aikido's analysis of the npm and PyPI LLM proxy backdoor

Context

A malicious package that runs code on import or install can turn a developer or Kubernetes server into an access broker before defenders notice. In this case, the primary security problem is not just malware execution, but the abuse of trusted software distribution to place an LLM relay, SSH access, and secrets-store reachability on the same compromised host. For IAM and NHI teams, that creates a bridge between package trust, workload access, and AI request handling.

The article is also a supply-chain and identity story because the implant uses hardcoded credentials, reverse tunnels, and proxy routing to move through trusted paths. That means the control gap sits across software provenance, host hardening, and NHI governance for service endpoints that should never be able to mediate model traffic. This pattern is increasingly typical in environments where AI tooling, Kubernetes, and secrets stores share the same operational surface.

Key questions

Q: What breaks when a malicious package can relay AI traffic through a server?

A: The main failure is trust boundary collapse. The server is no longer just an execution environment, it becomes an intermediary that can observe, reroute, or manipulate prompts, tool calls, and responses. That can expose secrets, distort model output, and create a hidden dependency between software installation and AI governance.

Q: Why do compromised hosts create a higher risk for AI model access than ordinary malware?

A: They can sit between clients and upstream model services, which means the attacker can see sensitive context before the model responds. That makes prompt content, tool output, and embedded credentials accessible in transit. The risk rises further when the same host also reaches SSH or secrets-store ports.

Q: How do security teams detect package abuse that hides behind legitimate-looking Kubernetes names?

A: Focus on behaviour rather than package names. Look for native binaries in install paths, unexpected network calls during dependency setup, temporary file creation in system locations, and process names that mimic health checks. Those signals are stronger than filename review alone.

Q: Who is accountable when a compromised dependency exposes model traffic and internal services?

A: Accountability sits with the teams that own software provenance, runtime segmentation, and AI traffic governance. Security, platform, and application owners all have a role, because the attack succeeds when dependency trust, host access, and model relay paths are treated as separate problems.

Technical breakdown

How a malicious package becomes a stage-one dropper

The first stage is delivered through ordinary package-install mechanics, but the payload is a native binary that executes immediately on import or require(). In Python, a compiled extension can run before a developer has time to inspect behaviour; in npm, a native addon can do the same during dependency installation. The dropper then pulls a second-stage binary from GitHub, writes it to a temporary path, and launches it with embedded configuration. That design reduces visible artefacts and shifts most malicious logic into a more capable second stage.

Practical implication: block unsigned or unexpected native binaries in dependency pipelines and inspect install-time execution paths, not just runtime behaviour.

Why the implant behaves like an LLM proxy and relay node

The second stage is not only remote access malware. It implements a WebSocket backhaul, SSH session capability, SOCKS5 proxying, SFTP access, and an OpenAI-compatible API gateway that rewrites requests to upstream model routers. Because the proxy sees requests and responses in transit, it can observe prompts, tool calls, and returned content before forwarding them. That makes the host a trust boundary, not just an endpoint, because the attacker can mediate model interactions and potentially alter or inspect them without changing the client application.

Practical implication: treat any server that can relay model traffic as part of your AI control plane and restrict it with explicit network and identity boundaries.

How the malware hides persistence and operator access

The implant clears environment variables, renames itself to look like node-health-check, deletes temporary files, and removes the original package directory shortly after launch. It also embeds hardcoded authentication and reverse tunnels to exposed internal services, including SSH and a secrets store port. That combination makes forensic recovery difficult and creates a path from a single package install to interactive access, file transfer, and service exposure on the victim machine.

Practical implication: monitor install-time process trees, environment-variable tampering, and sudden tunnel creation from package managers into internal ports.

Threat narrative

Attacker objective: The attacker aims to convert compromised servers into reusable LLM relay nodes that provide proxy access, internal service reach, and visibility into model traffic.

1. Entry occurs when a malicious npm or PyPI package is installed and its native dropper executes during import or require().
2. Credential access and relay setup follow when the second-stage implant establishes authenticated tunnels, exposes SSH and Vault-adjacent ports, and turns the host into a proxy for model traffic.
3. Impact occurs when attacker-controlled infrastructure can observe, reroute, or abuse AI requests and internal services through the compromised server.

NHI Mgmt Group analysis

Supply-chain malware is becoming an identity problem, not just a code problem. When a package can install a relay, open tunnels, and impersonate legitimate process names, the real asset under attack is trust in software execution and host identity. That shifts the governance question from whether the package is malicious to which runtime identities can reach model traffic, SSH, and secrets stores. Practitioners should treat package installation as an access event with identity consequences.

LLM relays create a new form of context-window interception. The attacker does not need to own the model or the client if they can sit between them and inspect or rewrite requests in transit. That creates a distinctive named concept here: context-window relay risk: the exposure that arises when prompts, tools, and returned content traverse an untrusted intermediary. For AI governance teams, this is a data-handling and NHI boundary issue at the same time.

Standing access on compromised hosts is the real multiplier. The implant’s reverse tunnels and hardcoded credentials show how quickly one foothold can become persistent operator reach. In identity terms, the control gap is lifecycle and scope, not just detection. If a host can reach internal services without tight session bounds, the attacker inherits that reach the moment code executes. Practitioners should tighten the relationship between machine identity, network reach, and session duration.

AI supply-chain attacks now intersect with secrets governance by design. The malware’s ability to expose ports for SSH and Vault-like services demonstrates that package compromise can become secrets compromise without any explicit vault exploit. That means secrets policy cannot live separately from software provenance and runtime isolation. Teams should evaluate whether AI workloads, build tools, and secrets stores are sharing assumptions that an attacker can collapse with one malicious dependency.

Kubernetes-targeting malware is increasingly optimized for low-noise conversion, not loud disruption. The article shows an operator focused on turning infrastructure into a serviceable proxy layer, which is consistent with monetisation, censorship bypass, and stealthy access operations. That matters because defenders often look for obvious destructive activity and miss infrastructure repurposing. Practitioners should tune governance for covert abuse of trusted compute, especially where AI traffic is involved.

What this signals

Context-window relay risk: this pattern shows that AI security programmes now need to monitor the path between clients and model providers, not just the model endpoint itself. When a compromised server can proxy prompts, tools, and outputs, the control objective becomes traffic integrity, not only access approval. That is where workload identity, egress control, and provenance checks converge.

The practical signal for teams is that AI usage is no longer isolated from supply-chain and infrastructure governance. If your environment allows package installs to create network listeners or tunnels, then AI request paths can be intercepted before you have a chance to inspect them. Tie model routing decisions to host trust, and review them alongside workload identity controls and egress policy.

The broader programme implication is that AI observability and secrets governance must be joined. A relay that can see prompts can also see credentials, and a tunnel that reaches internal services can turn one dependency issue into a multi-control incident. Teams should use OWASP Agentic AI Top 10 and NIST AI 600-1 Generative AI Profile to frame those dependencies explicitly.

For practitioners

• Block install-time execution of native extensions Require approval or sandboxing for compiled package artefacts that execute on import or require(), especially in npm and PyPI dependency paths.
• Inspect outbound tunnels from build and runtime hosts Alert on WebSocket backhauls, reverse tunnels, and unexpected proxy listeners from package-managed hosts into internal ports such as SSH or secrets stores.
• Segregate AI traffic from generic server trust zones Place model proxying, SSH access, and secrets management on separate host identities and network segments so one compromised node cannot mediate all three.
• Harden package provenance controls for Kubernetes environments Pin dependencies, verify publisher reputation, and scan for native binaries that masquerade as node health checks or other operational utilities.
• Treat prompt and tool traffic as sensitive data in transit Apply monitoring and egress policy to AI request and response paths, because a compromised relay can observe secrets, tool calls, and system prompts.

Key takeaways

• A malicious package can now convert a server into an AI relay that mediates prompts, tools, and responses.
• The evidence in this case shows a two-stage implant, hidden tunnelling, and extensive model routing capability, not simple malware noise.
• Defenders need to join supply-chain controls, host identity, and AI traffic governance before package installs become model access events.

Key terms

• LLM Relay: An LLM relay is an intermediary service that forwards prompts and responses between a client and upstream model providers. In malicious cases, the relay can inspect, modify, or exfiltrate content in transit, turning a convenience layer into a trust boundary that attackers control.
• Stage-One Dropper: A stage-one dropper is the first payload delivered by malware to establish execution and fetch the more capable second stage. It is often small, noisy only at install time, and designed to remove obvious artefacts while handing off command and control to a hidden component.
• Context-Window Relay Risk: Context-window relay risk is the exposure created when prompts, tool calls, and model outputs pass through an untrusted intermediary. The intermediary can observe sensitive context even if the original client and the final model are legitimate, which makes network path control part of AI governance.
• Install-Time Execution: Install-time execution is code that runs while dependencies are being installed rather than when an application is launched. In supply chain attacks, this matters because the install phase often has access to the richest secrets in developer and CI environments, making it a high-value privilege boundary.

What's in the full analysis

Aikido's full blog covers the operational detail this post intentionally leaves for the source:

• The complete package names, hashes, and network indicators needed for detection engineering and IOC tuning.
• The full dropper and stage-two analysis, including the exact config fields that expose SSH, Vault, and LLM proxy tunnels.
• The detailed behaviour of the OpenAI-compatible proxy, including upstream routing patterns and model path mapping.
• The article's practical guidance for Aikido users, including feed triage and rescan steps.

👉 Aikido's full post covers the attack chain, indicators, and proxy behaviour in detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and workload identity. It helps security practitioners connect identity controls to the broader access paths that modern infrastructure and AI systems depend on.