registry / anon-pi / 0.15.0

anon-pi@0.15.0

Launch pi inside a netcage: anonymized web egress through a socks5h proxy, one direct hole for a local model, seeded pi config on the host.

AI Security Review

scanned 19h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a user-invoked launcher for running the pi agent inside netcage with local workspace state and explicit init/delete/forward/snapshot commands.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the anon-pi CLI or its subcommands.

Impact

Creates and manages ~/.anon-pi state, launches netcage containers, optionally forwards ports or deletes selected anon-pi data; no stealth execution or exfiltration identified.

Mechanism

User-invoked container/agent launcher and configuration manager

Rationale

Static inspection shows risky primitives are aligned with the documented CLI purpose and are activated by explicit user commands, with no npm lifecycle hook, stealth persistence, credential harvesting, or outbound exfiltration endpoint. Agent-related state is seeded under anon-pi's own machine home/workspace and not planted into foreign AI-agent control surfaces at install time.

Evidence

package.jsondist/cli.jsdist/anon-pi.jsDockerfile.piexamples/Dockerfile.pi-webveilREADME.md~/.anon-pi/config.json~/.anon-pi/models.json~/.anon-pi/settings-seed.json~/.anon-pi/machines/<name>/machine.json~/.anon-pi/machines/<name>/home/.pi/agent/models.json~/.anon-pi/machines/<name>/home/.pi/agent/settings.json

Network endpoints3

socks5h://127.0.0.1:9050socks5h://127.0.0.1:1080<ANON_PI_LLM>/v1/models

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/cli.js exposes user-invoked CLI that spawns netcage/podman/sh and can delete/copy ~/.anon-pi machine/project data with explicit verbs.
dist/cli.js init reads host pi models config and may carry a matching local provider apiKey only with --force-allow-local-llm-api-key.
Dockerfile.pi and examples/Dockerfile.pi-webveil stage pi agent trust/config under /opt/anon-pi-seed/agent for later machine-home seeding.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks; only bin anon-pi points to dist/cli.js.
dist/cli.js actions are CLI-triggered and documented; no import-time execution or automatic agent/control-surface writes.
dist/anon-pi.js resolveRunPlan requires ANON_PI_PROXY/config proxy plus one ANON_PI_LLM direct target and runs via netcage with --proxy/--allow-direct.
Writes are scoped to ~/.anon-pi or ANON_PI_HOME machine/project state, except reading matching host pi models.json during interactive init.
Network probes target user-selected local SOCKS/local-model endpoints or netcage; no hardcoded exfiltration endpoint found.
Destructive rmSync paths require explicit delete/rm commands with TTY confirmation or --yes.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 6 file(s), 437 KB of source, external domains: github.com

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// anon-pi CLI: the THIN impure launch path. Parses grammar A (pure

3// parseLaunchArgs), reads config.json / machine.json + resolves the machine,

4// composes the LaunchIntent, resolves the RunPlan (pure resolveRunPlan), decides

5// run-vs-start against real netcage for `--keep`, and spawns netcage with

6// inherited stdio (so -it is a real interactive TTY), propagating the exit code.

7//

8// All the DECISIONS live in the pure module (anon-pi.ts); this file only does

9// I/O: fs reads/mkdirs, the netcage query, the spawn, and the TTY discipline.

10// The forced-egress invariant is the RunPlan's guarantee: the composed argv

11// ALWAYS carries --proxy + the one --allow-direct; the CLI never strips or adds

12// egress.

13import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';

14import { readSync } from 'node:fs';

15import { spawnSync, execFileSync } from 'node:child_process';

16import { join, dirname, resolve } from 'node:path';

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L14

17import { AnonPiError, HELP, MODELS_FILE, SETTINGS_FILE, SETTINGS_SEED_FILE, SEED_MARKER, DEFAULT_MACHINE, envFromProcess, buildMenuChoiceList, buildMenuEntries, builtinProjectsRoot, deriveProjectUsage, expandTilde, findingsFromNetcageDetect, processNoteFromNetcageDetect, resolveNetcageGraphroot, globalModelsSeedPath, globalSettingsSeedPath, machineAgentDir, machineDir, machineHomeDir, machineJsonPath, machineModelsSeedPath, machineSessionsDir, mergeModelSelection, resolveModelsSeedPath, resolveSettingsSeedPath, validateName, resolveDeleteHome, resolveDeleteProject, parseConfigJson, parseLaunch ...

18// The netcage label anon-pi stamps its launch-identity key onto (keptContainerKey)

19// so a `--keep` re-entry can find and `netcage start` the same kept container.

20// netcage's `netcage.managed` label marks it a managed container; this adds the

21// anon-pi identity ON TOP (netcage's label IS the registry; anon-pi adds no file).

22const ANON_PI_KEY_LABEL = 'anon-pi.key';

23function main(argv) {

24 const args = argv.slice(2);

25 // `--version`/`-V` prints anon-pi's own version and exits (before the launch

26 // grammar, so it is never parsed as a project/flag). For pi's version inside

27 // the jail, forward it: `anon-pi pi --version`.

28 if (args[0] === '--version' || args[0] === '-V') {

29 process.stdout.write(`anon-pi ${anonPiVersion() ?? '(unknown)'}\n`);

30 return 0;

31 }

32 // The global `--help`/`-h` prints the top-level HELP, EXCEPT when the first

33 // token is a subcommand that owns its own `--help` (so `anon-pi init --help`

34 // and `anon-pi machine --help` show THEIR help, not the global one). Those

Long lines were clipped for display.

Lines 1157-1197javascript

1157 const ans = promptLine(`Choose a number, or enter host:port${prefill}: `);

1158 if (ans === undefined) {

1159 process.stderr.write('anon-pi: aborted; nothing written.\n');

1160 return undefined;

1161 }

1162

Lines 1696-1736javascript

1696 * `netcage build`/`load` verbs remove this dance). Returns true on success.

1697 */

1698function loadImageIntoNetcageStore(tag) {

1699 const graphroot = resolveNetcageGraphroot(process.env);

1700 process.stdout.write(` Loading ${tag} into netcage's store (${graphroot}) so

Source & flagged code

3 flagged · loading source

dist/cli.jsView file

14import { readSync } from 'node:fs'; L15: import { spawnSync, execFileSync } from 'node:child_process'; L16: import { join, dirname, resolve } from 'node:path';

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L14

1716} L1717: /** Minimal POSIX single-quote shell-quoting for a token embedded in `sh -c`. */ L1718: function shQuote(s) {

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L1716

1177if (chosen === undefined || chosen === '') { L1178: process.stdout.write(' Please pick a listed number or enter a host:port.\n'); L1179: continue; ... L1187: process.stderr.write('anon-pi: `netcage` not found on PATH, cannot verify the exit IP. Install\n' + L1188: 'it first (https://github.com/wighawag/netcage). Linux only.\n'); L1189: return undefined; L1190: } L1191: const verify = spawnSync('netcage', ['verify', '--proxy', url], { L1192: encoding: 'utf8',

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L1177

Findings

3 High2 Medium5 Low

HighChild Processdist/cli.js

HighShelldist/cli.js

HighCommand Output Exfiltrationdist/cli.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// anon-pi CLI: the THIN impure launch path. Parses grammar A (pure

3// parseLaunchArgs), reads config.json / machine.json + resolves the machine,

4// composes the LaunchIntent, resolves the RunPlan (pure resolveRunPlan), decides

5// run-vs-start against real netcage for `--keep`, and spawns netcage with

6// inherited stdio (so -it is a real interactive TTY), propagating the exit code.

7//

8// All the DECISIONS live in the pure module (anon-pi.ts); this file only does

9// I/O: fs reads/mkdirs, the netcage query, the spawn, and the TTY discipline.

10// The forced-egress invariant is the RunPlan's guarantee: the composed argv

11// ALWAYS carries --proxy + the one --allow-direct; the CLI never strips or adds

12// egress.

13import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';

14import { readSync } from 'node:fs';

15import { spawnSync, execFileSync } from 'node:child_process';

16import { join, dirname, resolve } from 'node:path';

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L14

18// The netcage label anon-pi stamps its launch-identity key onto (keptContainerKey)

19// so a `--keep` re-entry can find and `netcage start` the same kept container.

20// netcage's `netcage.managed` label marks it a managed container; this adds the

21// anon-pi identity ON TOP (netcage's label IS the registry; anon-pi adds no file).

22const ANON_PI_KEY_LABEL = 'anon-pi.key';

23function main(argv) {

24 const args = argv.slice(2);

25 // `--version`/`-V` prints anon-pi's own version and exits (before the launch

26 // grammar, so it is never parsed as a project/flag). For pi's version inside

27 // the jail, forward it: `anon-pi pi --version`.

28 if (args[0] === '--version' || args[0] === '-V') {

29 process.stdout.write(`anon-pi ${anonPiVersion() ?? '(unknown)'}\n`);

30 return 0;

31 }

32 // The global `--help`/`-h` prints the top-level HELP, EXCEPT when the first

33 // token is a subcommand that owns its own `--help` (so `anon-pi init --help`

34 // and `anon-pi machine --help` show THEIR help, not the global one). Those

Long lines were clipped for display.

Lines 1157-1197javascript

1157 const ans = promptLine(`Choose a number, or enter host:port${prefill}: `);

1158 if (ans === undefined) {

1159 process.stderr.write('anon-pi: aborted; nothing written.\n');

1160 return undefined;

1161 }

1162

Lines 1696-1736javascript

1696 * `netcage build`/`load` verbs remove this dance). Returns true on success.

1697 */

1698function loadImageIntoNetcageStore(tag) {

1699 const graphroot = resolveNetcageGraphroot(process.env);

1700 process.stdout.write(` Loading ${tag} into netcage's store (${graphroot}) so