registry / anon-pi / 0.20.0

anon-pi@0.20.0

Launch pi inside a netcage: anonymized web egress through a socks5h proxy, one direct hole for a local model, seeded pi config on the host.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a CLI that launches pi inside netcage with forced proxy egress and writes its own anon-pi workspace state when the user runs setup or launch commands.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs anon-pi CLI commands such as init, launch, machine, image, container, forward, or ports.

Impact

Creates/removes anon-pi-managed config, machine homes, project dirs, containers/images, and local model seed files as requested by CLI verbs.

Mechanism

User-invoked netcage/container orchestration and anon-pi workspace configuration.

Rationale

Static source inspection shows suspicious primitives are package-aligned runtime functionality for an explicit privacy/container launcher, with no install-time execution, stealth persistence, credential exfiltration, or unconsented broad AI-agent control mutation. Mark clean despite scanner hits on child_process/network because they are bounded to user-invoked setup, probing, and netcage orchestration.

Evidence

package.jsonsrc/cli.tssrc/anon-pi.tsdist/cli.jsDockerfile.piexamples/Dockerfile.pi-webveil~/.anon-pi/config.json~/.anon-pi/models.json~/.anon-pi/settings.seed.json~/.anon-pi/machines/<name>/machine.json~/.anon-pi/machines/<name>/home~/.anon-pi/projects/<project>/opt/anon-pi-seed/agent/trust.json

Network endpoints4

127.0.0.1<host:port>/v1/modelssocks5h://<host:port>github.com/wighawag/netcage

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

src/cli.ts uses child_process spawnSync/execFileSync for netcage, podman, ps, sh -c, and Node helper probes.
src/cli.ts writes/removes ~/.anon-pi config, machine homes, model seeds, and project dirs during explicit CLI commands.
Dockerfile.pi stages pi agent trust.json defaults under /opt/anon-pi-seed/agent for later home seeding.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks; bin is explicit ./dist/cli.js.
Command execution is user-invoked CLI behavior for a netcage/container launcher, not install-time or import-time execution.
Network probing/fetching is limited to user-selected SOCKS/local model setup and netcage verification in interactive init.
No credential harvesting or exfiltration flow found; real local LLM API keys are refused unless user passes --force-allow-local-llm-api-key.
Shell use is bounded to quoted podman save/load and in-container seed commands, aligned with package function.
No AI-agent control-surface mutation occurs during npm install; agent config is seeded only into anon-pi machine homes/images on user commands.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 6 file(s), 563 KB of source, external domains: github.com

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// anon-pi CLI: the THIN impure launch path. Parses grammar A (pure

3// parseLaunchArgs), reads config.json / machine.json + resolves the machine,

4// composes the LaunchIntent, resolves the RunPlan (pure resolveRunPlan; every

5// launch is throwaway), and spawns netcage with inherited stdio (so -it is a

6// real interactive TTY), propagating the exit code.

7//

8// All the DECISIONS live in the pure module (anon-pi.ts); this file only does

9// I/O: fs reads/mkdirs, the netcage query, the spawn, and the TTY discipline.

10// The forced-egress invariant is the RunPlan's guarantee: the composed argv

11// ALWAYS carries --proxy + the one --allow-direct; the CLI never strips or adds

12// egress.

13import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';

14import { readSync } from 'node:fs';

15import { spawnSync, execFileSync } from 'node:child_process';

16import { join, dirname, resolve } from 'node:path';

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L14

17import { AnonPiError, HELP, MODELS_FILE, SETTINGS_FILE, SETTINGS_SEED_FILE, SEED_MARKER, DEFAULT_MACHINE, envFromProcess, buildMenuChoiceList, buildMenuEntries, builtinProjectsRoot, deriveProjectUsage, expandTilde, findingsFromNetcageDetect, processNoteFromNetcageDetect, resolveNetcageGraphroot, globalModelsSeedPath, globalSettingsSeedPath, machineAgentDir, machineDir, machineHomeDir, machineJsonPath, machineModelsSeedPath, machineSessionsDir, mergeModelSelection, resolveModelsSeedPath, resolveSettingsSeedPath, validateName, resolveDeleteHome, resolveDeleteProject, parseConfigJson, parseLaunch ...

18// The netcage label anon-pi stamps its launch-identity key onto (launchIdentityKey)

19// so `forward`/`ports`/`snapshot` can find the RUNNING container by machine +

20// project while it is up. netcage's `netcage.managed` label marks it a managed

21// container; this adds the anon-pi identity ON TOP (netcage's label IS the

22// registry; anon-pi adds no file).

23const ANON_PI_KEY_LABEL = 'anon-pi.key';

24function main(argv) {

25 const args = argv.slice(2);

26 // `--version`/`-V` prints anon-pi's own version and exits (before the launch

27 // grammar, so it is never parsed as a project/flag). For pi's version inside

28 // the jail, forward it: `anon-pi pi --version`.

29 if (args[0] === '--version' || args[0] === '-V') {

30 process.stdout.write(`anon-pi ${anonPiVersion() ?? '(unknown)'}\n`);

31 return 0;

32 }

33 // The global `--help`/`-h` prints the top-level HELP, EXCEPT when the first

34 // token is a subcommand that owns its own `--help` (so `anon-pi init --help`

Long lines were clipped for display.

Lines 1669-1709javascript

1669 const ans = promptLine(`Choose a number, or enter host:port${prefill}: `);

1670 if (ans === undefined) {

1671 process.stderr.write('anon-pi: aborted; nothing written.\n');

1672 return undefined;

1673 }

1674

Lines 2208-2248javascript

2208 * `netcage build`/`load` verbs remove this dance). Returns true on success.

2209 */

2210function loadImageIntoNetcageStore(tag) {

2211 const graphroot = resolveNetcageGraphroot(process.env);

2212 process.stdout.write(` Loading ${tag} into netcage's store (${graphroot}) so

Source & flagged code

3 flagged · loading source

dist/cli.jsView file

14import { readSync } from 'node:fs'; L15: import { spawnSync, execFileSync } from 'node:child_process'; L16: import { join, dirname, resolve } from 'node:path';

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L14

2228} L2229: /** Minimal POSIX single-quote shell-quoting for a token embedded in `sh -c`. */ L2230: function shQuote(s) {

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L2228

1689if (chosen === undefined || chosen === '') { L1690: process.stdout.write(' Please pick a listed number or enter a host:port.\n'); L1691: continue; ... L1699: process.stderr.write('anon-pi: `netcage` not found on PATH, cannot verify the exit IP. Install\n' + L1700: 'it first (https://github.com/wighawag/netcage). Linux only.\n'); L1701: return undefined; L1702: } L1703: const verify = spawnSync('netcage', ['verify', '--proxy', url], { L1704: encoding: 'utf8',

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L1689

Findings

3 High2 Medium5 Low

HighChild Processdist/cli.js

HighShelldist/cli.js

HighCommand Output Exfiltrationdist/cli.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// anon-pi CLI: the THIN impure launch path. Parses grammar A (pure

3// parseLaunchArgs), reads config.json / machine.json + resolves the machine,

4// composes the LaunchIntent, resolves the RunPlan (pure resolveRunPlan; every

5// launch is throwaway), and spawns netcage with inherited stdio (so -it is a

6// real interactive TTY), propagating the exit code.

7//

8// All the DECISIONS live in the pure module (anon-pi.ts); this file only does

9// I/O: fs reads/mkdirs, the netcage query, the spawn, and the TTY discipline.

10// The forced-egress invariant is the RunPlan's guarantee: the composed argv

11// ALWAYS carries --proxy + the one --allow-direct; the CLI never strips or adds

12// egress.

13import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';

14import { readSync } from 'node:fs';

15import { spawnSync, execFileSync } from 'node:child_process';

16import { join, dirname, resolve } from 'node:path';

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L14

18// The netcage label anon-pi stamps its launch-identity key onto (launchIdentityKey)

19// so `forward`/`ports`/`snapshot` can find the RUNNING container by machine +

20// project while it is up. netcage's `netcage.managed` label marks it a managed

21// container; this adds the anon-pi identity ON TOP (netcage's label IS the

22// registry; anon-pi adds no file).

23const ANON_PI_KEY_LABEL = 'anon-pi.key';

24function main(argv) {

25 const args = argv.slice(2);

26 // `--version`/`-V` prints anon-pi's own version and exits (before the launch

27 // grammar, so it is never parsed as a project/flag). For pi's version inside

28 // the jail, forward it: `anon-pi pi --version`.

29 if (args[0] === '--version' || args[0] === '-V') {

30 process.stdout.write(`anon-pi ${anonPiVersion() ?? '(unknown)'}\n`);

31 return 0;

32 }

33 // The global `--help`/`-h` prints the top-level HELP, EXCEPT when the first

34 // token is a subcommand that owns its own `--help` (so `anon-pi init --help`

Long lines were clipped for display.

Lines 1669-1709javascript

1669 const ans = promptLine(`Choose a number, or enter host:port${prefill}: `);

1670 if (ans === undefined) {

1671 process.stderr.write('anon-pi: aborted; nothing written.\n');

1672 return undefined;

1673 }

1674

Lines 2208-2248javascript

2208 * `netcage build`/`load` verbs remove this dance). Returns true on success.

2209 */

2210function loadImageIntoNetcageStore(tag) {

2211 const graphroot = resolveNetcageGraphroot(process.env);

2212 process.stdout.write(` Loading ${tag} into netcage's store (${graphroot}) so