Notifications
Clear all
Topic starter
02/08/2026 11:44 am
TL;DR: Malicious npm and PyPI packages named kube-health-tools and kube-node-health installed a two-stage implant that turned compromised servers into LLM relays, exposed SSH and Vault ports, and proxied chat traffic through attacker-controlled infrastructure, according to Aikido. Supply-chain compromise is now a direct AI governance issue because intercepted model traffic can carry secrets, prompts, and tool calls.
NHIMG editorial — based on content published by Aikido covering a malicious npm and PyPI LLM proxy backdoor: GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays
By the numbers:
- The binary contains 109 hardcoded model name strings used to build the /v1/models response.
Questions worth separating out
Q: What breaks when a malicious package can relay AI traffic through a server?
A: The main failure is trust boundary collapse.
Q: Why do compromised hosts create a higher risk for AI model access than ordinary malware?
A: They can sit between clients and upstream model services, which means the attacker can see sensitive context before the model responds.
Q: How do security teams detect package abuse that hides behind legitimate-looking Kubernetes names?
A: Focus on behaviour rather than package names.
Practitioner guidance
- Block install-time execution of native extensions Require approval or sandboxing for compiled package artefacts that execute on import or require(), especially in npm and PyPI dependency paths.
- Inspect outbound tunnels from build and runtime hosts Alert on WebSocket backhauls, reverse tunnels, and unexpected proxy listeners from package-managed hosts into internal ports such as SSH or secrets stores.
- Segregate AI traffic from generic server trust zones Place model proxying, SSH access, and secrets management on separate host identities and network segments so one compromised node cannot mediate all three.
What's in the full analysis
Aikido's full blog covers the operational detail this post intentionally leaves for the source:
- The complete package names, hashes, and network indicators needed for detection engineering and IOC tuning.
- The full dropper and stage-two analysis, including the exact config fields that expose SSH, Vault, and LLM proxy tunnels.
- The detailed behaviour of the OpenAI-compatible proxy, including upstream routing patterns and model path mapping.
- The article's practical guidance for Aikido users, including feed triage and rescan steps.
👉 Read Aikido's analysis of the npm and PyPI LLM proxy backdoor →
LLM proxy malware in npm and PyPI: what teams need to know?
Explore further
02/08/2026 12:55 pm
Supply-chain malware is becoming an identity problem, not just a code problem. When a package can install a relay, open tunnels, and impersonate legitimate process names, the real asset under attack is trust in software execution and host identity. That shifts the governance question from whether the package is malicious to which runtime identities can reach model traffic, SSH, and secrets stores. Practitioners should treat package installation as an access event with identity consequences.
A question worth separating out:
Q: Who is accountable when a compromised dependency exposes model traffic and internal services?
A: Accountability sits with the teams that own software provenance, runtime segmentation, and AI traffic governance. Security, platform, and application owners all have a role, because the attack succeeds when dependency trust, host access, and model relay paths are treated as separate problems.
👉 Read our full editorial: LLM proxy malware in npm and PyPI turns servers into relays
