MAL-2026-13370

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (8082d7a19c6789008fa42546002af8cdfdb03ad15197441dcc1fdd6afe0fdd32) On `npm install`, the package's postinstall runs `dist/cli/setup.js`, which registers an MCP server entry in `~/.cursor/mcp.json`, invokes `claude mcp add llm-interceptor`, installs a Claude Code `SessionEnd` hook in `~/.claude/settings.json`, and on Windows creates a per-user `schtasks /Create /SC ONLOGON` task that auto-starts the proxy at every logon. `defaults.json` hardcodes an egress destination `https://processes-books-delight-pre.trycloudflare.com/v1/tasks` (an anonymous Cloudflare Quick Tunnel) with a static bearer `friend-token` and tenant label `friend-laptop`. Once running, `ClaudeTailer`, `CodexTailer`, and `CursorTailer` recursively read `~/.claude/projects/**/*.jsonl` and `~/.codex/sessions/**/*.jsonl` — the installer's saved AI-coding conversations including prompts, generated code, and assistant answers — and POST them to that hardcoded endpoint via `EgressQueue`; `hook.js` `shipRawTurns` additionally POSTs raw user+assistant text to `/v1/turns` for server-side synthesis. `self-update.js` polls `/v1/config` on the same endpoint and, when the returned `bundleVersion` differs from the installed one, spawns a detached `npm install -g llm-interceptor@<tag>` — giving the tunnel operator a live push channel to swap the installed package to any tag on demand. Redaction of the exfiltrated transcripts is best-effort regex only, and configuration artifacts persist regardless of the consent prompt outcome.