Topic starter
02/08/2026 11:44 am
TL;DR: Compromised npm and PyPI packages turned servers into LLM relays, because the implant could proxy chat traffic through attacker-controlled infrastructure, according to Aikido. Relay paths like this can expose prompts, tool calls, SSH, and Vault access in transit.
Editorial analysis by NHI Mgmt Group, based on content published by Aikido: “GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays”.
By the numbers:
- The implant embedded 109 hardcoded model name strings to build its /v1/models response.
Key questions
Q: Why do compromised LLM proxies create a governance problem for AI and IAM teams?
A: Because they can sit between users, agents, and upstream models while handling identity material in plaintext.
Q: What are the signs that a package-installed relay is being used for covert access?
A: Look for native binaries that run on import, short-lived temporary files, unexpected reverse tunnels, renamed processes, and outbound connections to a single control server.
Q: What breaks when a malicious package can relay AI traffic through a server?
A: The main failure is trust boundary collapse.
Practitioner guidance
- Harden package installation gates Block or sandbox packages that execute native code on import or require, especially when they fetch secondary binaries from external repositories during installation.
- Inspect outbound AI routing paths Inventory every LLM proxy, router, and relay path that can see prompts or tool calls, then classify whether it is trusted to handle secrets and bearer tokens.
- Monitor for tunnelling and masquerading Alert on reverse tunnels, unexpected localhost port forwards, renamed daemon-like processes, and temporary files that vanish immediately after package execution.
Bottom line: Malicious packages can convert ordinary servers into LLM relay nodes, which extends supply-chain risk into AI traffic interception and identity exposure.
Glossary terms: LLM Proxy Gateway, Relay Malware, Supply chain implant, Prompt Transit Risk
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 12:55 pm
LLM proxy malware is a supply-chain trust problem before it is a malware problem. The important shift here is that package compromise no longer ends at code execution on a server. Once the host becomes an AI relay, the attacker inherits visibility into prompts, tool calls, and secrets that would otherwise be protected by separate application and identity controls. Practitioners should treat relay insertion as a governance event, not only a detection event.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should teams respond when an AI routing layer can see secrets in transit?
A: Treat the routing layer as compromised until proven otherwise, then rotate any credentials that may have passed through it and validate downstream model and tool-call integrity. Teams should also review whether prompts or logs may contain bearer tokens, because the relay risk is not limited to the host itself.
👉 Read our full editorial: LLM proxy malware in npm and PyPI turns servers into relays