registry / anon-pi / 0.12.0

anon-pi@0.12.0

⚠ Under review

Launch pi inside a netcage: anonymized web egress through a socks5h proxy, one direct hole for a local model, seeded pi config on the host.

Static Scan Results

scanned 20h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 6 file(s), 407 KB of source, external domains: github.com

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// anon-pi CLI: the THIN impure launch path. Parses grammar A (pure

3// parseLaunchArgs), reads config.json / machine.json + resolves the machine,

4// composes the LaunchIntent, resolves the RunPlan (pure resolveRunPlan), decides

5// run-vs-start against real netcage for `--keep`, and spawns netcage with

6// inherited stdio (so -it is a real interactive TTY), propagating the exit code.

7//

8// All the DECISIONS live in the pure module (anon-pi.ts); this file only does

9// I/O: fs reads/mkdirs, the netcage query, the spawn, and the TTY discipline.

10// The forced-egress invariant is the RunPlan's guarantee: the composed argv

11// ALWAYS carries --proxy + the one --allow-direct; the CLI never strips or adds

12// egress.

13import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';

14import { readSync } from 'node:fs';

15import { spawnSync, execFileSync } from 'node:child_process';

16import { join, dirname, resolve } from 'node:path';

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L14

17import { AnonPiError, HELP, MODELS_FILE, SETTINGS_FILE, SETTINGS_SEED_FILE, SEED_MARKER, DEFAULT_MACHINE, envFromProcess, buildMenuChoiceList, buildMenuEntries, builtinProjectsRoot, deriveProjectUsage, expandTilde, findingsFromNetcageDetect, processNoteFromNetcageDetect, resolveNetcageGraphroot, globalModelsSeedPath, globalSettingsSeedPath, machineAgentDir, machineDir, machineHomeDir, machineJsonPath, machineModelsSeedPath, machineSessionsDir, mergeModelSelection, resolveModelsSeedPath, resolveSettingsSeedPath, validateName, resolveDeleteHome, resolveDeleteProject, parseConfigJson, parseLaunch ...

18// The netcage label anon-pi stamps its launch-identity key onto (keptContainerKey)

19// so a `--keep` re-entry can find and `netcage start` the same kept container.

20// netcage's `netcage.managed` label marks it a managed container; this adds the

21// anon-pi identity ON TOP (netcage's label IS the registry; anon-pi adds no file).

22const ANON_PI_KEY_LABEL = 'anon-pi.key';

23function main(argv) {

24 const args = argv.slice(2);

25 // `--version`/`-V` prints anon-pi's own version and exits (before the launch

26 // grammar, so it is never parsed as a project/flag). For pi's version inside

27 // the jail, forward it: `anon-pi pi --version`.

28 if (args[0] === '--version' || args[0] === '-V') {

29 process.stdout.write(`anon-pi ${anonPiVersion() ?? '(unknown)'}\n`);

30 return 0;

31 }

32 // The global `--help`/`-h` prints the top-level HELP, EXCEPT when the first

33 // token is a subcommand that owns its own `--help` (so `anon-pi init --help`

34 // and `anon-pi machine --help` show THEIR help, not the global one). Those

Long lines were clipped for display.

Lines 1018-1058javascript

1018 const ans = promptLine(`Choose a number, or enter host:port${prefill}: `);

1019 if (ans === undefined) {

1020 process.stderr.write('anon-pi: aborted; nothing written.\n');

1021 return undefined;

1022 }

1023

Lines 1557-1597javascript

1557 * `netcage build`/`load` verbs remove this dance). Returns true on success.

1558 */

1559function loadImageIntoNetcageStore(tag) {

1560 const graphroot = resolveNetcageGraphroot(process.env);

1561 process.stdout.write(` Loading ${tag} into netcage's store (${graphroot}) so

dist/anon-pi.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = anon-pi@0.11.1 matchedIdentity = npm:YW5vbi1waQ:0.11.1 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/anon-pi.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/cli.jsView file

14import { readSync } from 'node:fs'; L15: import { spawnSync, execFileSync } from 'node:child_process'; L16: import { join, dirname, resolve } from 'node:path';

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L14

1577} L1578: /** Minimal POSIX single-quote shell-quoting for a token embedded in `sh -c`. */ L1579: function shQuote(s) {

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L1577

1038if (chosen === undefined || chosen === '') { L1039: process.stdout.write(' Please pick a listed number or enter a host:port.\n'); L1040: continue; ... L1048: process.stderr.write('anon-pi: `netcage` not found on PATH, cannot verify the exit IP. Install\n' + L1049: 'it first (https://github.com/wighawag/netcage). Linux only.\n'); L1050: return undefined; L1051: } L1052: const verify = spawnSync('netcage', ['verify', '--proxy', url], { L1053: encoding: 'utf8',

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L1038

dist/anon-pi.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/anon-pi.jsView on unpkg

Findings

1 Critical3 High2 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/anon-pi.js

HighChild Processdist/cli.js

HighShelldist/cli.js

HighCommand Output Exfiltrationdist/cli.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// anon-pi CLI: the THIN impure launch path. Parses grammar A (pure

3// parseLaunchArgs), reads config.json / machine.json + resolves the machine,

4// composes the LaunchIntent, resolves the RunPlan (pure resolveRunPlan), decides

5// run-vs-start against real netcage for `--keep`, and spawns netcage with

6// inherited stdio (so -it is a real interactive TTY), propagating the exit code.

7//

8// All the DECISIONS live in the pure module (anon-pi.ts); this file only does

9// I/O: fs reads/mkdirs, the netcage query, the spawn, and the TTY discipline.

10// The forced-egress invariant is the RunPlan's guarantee: the composed argv

11// ALWAYS carries --proxy + the one --allow-direct; the CLI never strips or adds

12// egress.

13import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';

14import { readSync } from 'node:fs';

15import { spawnSync, execFileSync } from 'node:child_process';

16import { join, dirname, resolve } from 'node:path';

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L14

18// The netcage label anon-pi stamps its launch-identity key onto (keptContainerKey)

19// so a `--keep` re-entry can find and `netcage start` the same kept container.

20// netcage's `netcage.managed` label marks it a managed container; this adds the

21// anon-pi identity ON TOP (netcage's label IS the registry; anon-pi adds no file).

22const ANON_PI_KEY_LABEL = 'anon-pi.key';

23function main(argv) {

24 const args = argv.slice(2);

25 // `--version`/`-V` prints anon-pi's own version and exits (before the launch

26 // grammar, so it is never parsed as a project/flag). For pi's version inside

27 // the jail, forward it: `anon-pi pi --version`.

28 if (args[0] === '--version' || args[0] === '-V') {

29 process.stdout.write(`anon-pi ${anonPiVersion() ?? '(unknown)'}\n`);

30 return 0;

31 }

32 // The global `--help`/`-h` prints the top-level HELP, EXCEPT when the first

33 // token is a subcommand that owns its own `--help` (so `anon-pi init --help`

34 // and `anon-pi machine --help` show THEIR help, not the global one). Those

Long lines were clipped for display.

Lines 1018-1058javascript

1018 const ans = promptLine(`Choose a number, or enter host:port${prefill}: `);

1019 if (ans === undefined) {

1020 process.stderr.write('anon-pi: aborted; nothing written.\n');

1021 return undefined;

1022 }

1023

Lines 1557-1597javascript

1557 * `netcage build`/`load` verbs remove this dance). Returns true on success.

1558 */

1559function loadImageIntoNetcageStore(tag) {

1560 const graphroot = resolveNetcageGraphroot(process.env);

1561 process.stdout.write(` Loading ${tag} into netcage's store (${graphroot}) so

dist/anon-pi.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/anon-pi.jsView on unpkg