registry / anon-pi / 0.7.0

anon-pi@0.7.0

Launch pi inside a netcage: anonymized web egress through a socks5h proxy, one direct hole for a local model, seeded pi config on the host.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a user-invoked CLI that launches pi inside netcage, writes its own anon-pi workspace, and probes user-selected local/proxy endpoints during onboarding.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs anon-pi CLI commands such as anon-pi init, anon-pi <project>, machine, or delete verbs

Impact

Creates or updates anon-pi config, machine homes, models/settings seeds, and optionally launches netcage/podman; no install-time mutation or exfiltration observed.

Mechanism

Package-aligned container/agent launcher and workspace manager

Rationale

Static inspection shows suspicious primitives are expected for a CLI that launches netcage/podman, probes local endpoints, and manages its own workspace, with no lifecycle hook or hidden import-time behavior. Agent-related files are created only in the package's own anon-pi/pi machine context or documented Dockerfile staging, not unconsented foreign agent control surfaces.

Evidence

package.jsondist/cli.jsdist/anon-pi.jsDockerfile.piexamples/Dockerfile.pi-webveilREADME.md~/.anon-pi/config.json~/.anon-pi/models.json~/.anon-pi/settings-seed.json~/.anon-pi/machines/<name>/machine.json~/.anon-pi/machines/<name>/home/.pi/agent/models.json~/.anon-pi/machines/<name>/home/.pi/agent/settings.json~/.anon-pi/projects/<project>

Network endpoints3

127.0.0.1 SOCKS probe ports<user-selected-local-model-host>:<port>/v1/modelssocks5h://<user-selected-proxy-host>:<port>

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks; only bin anon-pi points to dist/cli.js
dist/cli.js actions are user-invoked CLI paths: init, launch, machine management, and explicit delete verbs
Child process use is package-aligned: netcage/podman/ps/node helpers, not hidden install-time execution
Network access is limited to user-chosen SOCKS/local model probing and netcage verify during interactive init
Writes are scoped to ~/.anon-pi machine/config/model files and container seed paths, with destructive deletes requiring --yes or TTY confirmation
No credential harvesting/exfiltration found; real host model apiKey is refused unless explicit --force-allow-local-llm-api-key

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 6 file(s), 313 KB of source, external domains: github.com

Source & flagged code

2 flagged

dist/cli.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// anon-pi CLI: the THIN impure launch path. Parses grammar A (pure

3// parseLaunchArgs), reads config.json / machine.json + resolves the machine,

4// composes the LaunchIntent, resolves the RunPlan (pure resolveRunPlan), decides

5// run-vs-start against real netcage for `--keep`, and spawns netcage with

6// inherited stdio (so -it is a real interactive TTY), propagating the exit code.

7//

8// All the DECISIONS live in the pure module (anon-pi.ts); this file only does

9// I/O: fs reads/mkdirs, the netcage query, the spawn, and the TTY discipline.

10// The forced-egress invariant is the RunPlan's guarantee: the composed argv

11// ALWAYS carries --proxy + the one --allow-direct; the CLI never strips or adds

12// egress.

13import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';

14import { readSync } from 'node:fs';

15import { spawnSync, execFileSync } from 'node:child_process';

16import { join, dirname, resolve } from 'node:path';

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L14

17import { AnonPiError, HELP, MODELS_FILE, SETTINGS_FILE, SETTINGS_SEED_FILE, SEED_MARKER, DEFAULT_MACHINE, envFromProcess, buildMenuChoiceList, buildMenuEntries, builtinProjectsRoot, deriveProjectUsage, globalModelsSeedPath, globalSettingsSeedPath, machineAgentDir, machineDir, machineHomeDir, machineJsonPath, machineModelsSeedPath, machineSessionsDir, mergeModelSelection, resolveModelsSeedPath, resolveSettingsSeedPath, validateName, resolveDeleteHome, resolveDeleteProject, parseConfigJson, parseLaunchArgs, parseMachineArgs, parseMachineJson, projectHostDir, resolveAnonPiHome, resolveLlm, resolv ...

18// The netcage label anon-pi stamps its launch-identity key onto (keptContainerKey)

19// so a `--keep` re-entry can find and `netcage start` the same kept container.

20// netcage's `netcage.managed` label marks it a managed container; this adds the

21// anon-pi identity ON TOP (netcage's label IS the registry; anon-pi adds no file).

22const ANON_PI_KEY_LABEL = 'anon-pi.key';

23function main(argv) {

24 const args = argv.slice(2);

25 // The global `--help`/`-h` prints the top-level HELP, EXCEPT when the first

26 // token is a subcommand that owns its own `--help` (so `anon-pi init --help`

27 // and `anon-pi machine --help` show THEIR help, not the global one). Those

28 // subcommands route to runInit / runMachine, which print INIT_HELP /

29 // MACHINE_HELP respectively.

30 const OWN_HELP_SUBCOMMANDS = new Set(['init', 'machine']);

31 if ((args.includes('--help') || args.includes('-h')) &&

32 !OWN_HELP_SUBCOMMANDS.has(args[0] ?? '')) {

33 process.stdout.write(HELP);

34 return 0;

Long lines were clipped for display.

Lines 975-1015javascript

975 const ans = promptLine(`Choose a number, or enter host:port${prefill}: `);

976 if (ans === undefined) {

977 process.stderr.write('anon-pi: aborted; nothing written.\n');

978 return undefined;

979 }

980 const

Source & flagged code

2 flagged · loading source

dist/cli.jsView file

14import { readSync } from 'node:fs'; L15: import { spawnSync, execFileSync } from 'node:child_process'; L16: import { join, dirname, resolve } from 'node:path';

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L14

995if (chosen === undefined || chosen === '') { L996: process.stdout.write(' Please pick a listed number or enter a host:port.\n'); L997: continue; ... L1005: process.stderr.write('anon-pi: `netcage` not found on PATH, cannot verify the exit IP. Install\n' + L1006: 'it first (https://github.com/wighawag/netcage). Linux only.\n'); L1007: return undefined; L1008: } L1009: const verify = spawnSync('netcage', ['verify', '--proxy', url], { L1010: encoding: 'utf8',

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L995

Findings

3 High2 Medium5 Low

HighChild Processdist/cli.js

HighShell

HighCommand Output Exfiltrationdist/cli.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

2 flagged

dist/cli.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// anon-pi CLI: the THIN impure launch path. Parses grammar A (pure

3// parseLaunchArgs), reads config.json / machine.json + resolves the machine,

4// composes the LaunchIntent, resolves the RunPlan (pure resolveRunPlan), decides

5// run-vs-start against real netcage for `--keep`, and spawns netcage with

6// inherited stdio (so -it is a real interactive TTY), propagating the exit code.

7//

8// All the DECISIONS live in the pure module (anon-pi.ts); this file only does

9// I/O: fs reads/mkdirs, the netcage query, the spawn, and the TTY discipline.

10// The forced-egress invariant is the RunPlan's guarantee: the composed argv

11// ALWAYS carries --proxy + the one --allow-direct; the CLI never strips or adds

12// egress.

13import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';

14import { readSync } from 'node:fs';

15import { spawnSync, execFileSync } from 'node:child_process';

16import { join, dirname, resolve } from 'node:path';

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L14

18// The netcage label anon-pi stamps its launch-identity key onto (keptContainerKey)

19// so a `--keep` re-entry can find and `netcage start` the same kept container.

20// netcage's `netcage.managed` label marks it a managed container; this adds the

21// anon-pi identity ON TOP (netcage's label IS the registry; anon-pi adds no file).

22const ANON_PI_KEY_LABEL = 'anon-pi.key';

23function main(argv) {

24 const args = argv.slice(2);

25 // The global `--help`/`-h` prints the top-level HELP, EXCEPT when the first

26 // token is a subcommand that owns its own `--help` (so `anon-pi init --help`

27 // and `anon-pi machine --help` show THEIR help, not the global one). Those

28 // subcommands route to runInit / runMachine, which print INIT_HELP /

29 // MACHINE_HELP respectively.

30 const OWN_HELP_SUBCOMMANDS = new Set(['init', 'machine']);

31 if ((args.includes('--help') || args.includes('-h')) &&

32 !OWN_HELP_SUBCOMMANDS.has(args[0] ?? '')) {

33 process.stdout.write(HELP);

34 return 0;

Long lines were clipped for display.

Lines 975-1015javascript

975 const ans = promptLine(`Choose a number, or enter host:port${prefill}: `);

976 if (ans === undefined) {

977 process.stderr.write('anon-pi: aborted; nothing written.\n');

978 return undefined;

979 }

980 const