registry / Credential exfiltration / anyray-connect

anyray-connect

Anyray connect — points local coding tools (Claude Code, Cursor, Windsurf, SDKs) at the Anyray gateway through supported configuration and enrolled personal authentication.

This report shows the evidence for anyray-connect@0.11.101. 1 of 130 known versions is blocked or flagged. The newest version, 0.11.448, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Source confirms credential harvesting from third-party application stores, automatic reachability from the main apply path, persistence, and use in gateway-routed traffic. The absence of an npm install hook does not remove the concrete runtime credential-exfiltration chain.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs the normal anyray-connect apply flow; copilot-cli is an automatic adapter.

Impact

Existing GitHub Copilot credentials can be repurposed and exposed to the configured gateway.

Mechanism

Credential harvesting, validation, persistence, and gateway forwarding

Attack narrative

On a normal apply, the automatic copilot-cli adapter searches Copilot and OpenCode credential stores for OAuth tokens, probes them with GitHub, then writes a discovered token to an Anyray-owned credential file and configures Copilot CLI to use a gateway lane. This repurposes credentials belonging to separate applications without requiring explicit selection of the adapter on non-macOS systems.

AI rationale

Evidence

package.jsondist/tools/index.jsdist/util/copilotSeatToken.jsdist/tools/copilotCli.jsdist/cli.js~/.copilot/config.json~/.config/github-copilot/apps.json~/.config/github-copilot/hosts.json~/.local/share/opencode/auth.json~/.anyray/copilot-cli.sh

Network endpoints5

api.github.com/copilot_internal/userapi.githubcopilot.comapi.individual.githubcopilot.comapi.business.githubcopilot.comapi.enterprise.githubcopilot.com

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

dist/util/copilotSeatToken.js reads OAuth tokens from Copilot/OpenCode credential stores and env.
It sends each discovered bearer token to https://api.github.com/copilot_internal/user.
dist/tools/copilotCli.js registers copilot-cli as automatic.
The adapter writes the discovered token into ~/.anyray/copilot-cli.sh and routes Copilot CLI through the configured gateway.

Evidence against

package.json has only prepublishOnly; no install-time lifecycle hook.
macOS Keychain value access requires an explicit copilot-cli selection.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 136 file(s), 1.82 MB of source, external domains: 127.0.0.1, api.business.githubcopilot.com, api.enterprise.githubcopilot.com, api.github.com, api.githubcopilot.com, api.individual.githubcopilot.com, app.anyray.ai, chatgpt.com, github.com, gw.acme.com, opencode.ai, www.apple.com

Source & flagged code

4 flagged

dist/commands/managed.jsView file

56Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/cli.js -> dist/commands/managed.js L56: ${bold('Modes')} (pick one) L57: --print Emit the managed-settings JSON to stdout for MDM packaging L58: (Jamf profile, Ansible template, etc.). Writes nothing unless ... L101: (UTF-8, no BOM). Prefer it over a shell redirect when L102: packaging from PowerShell, where \`>\` writes UTF-16LE on L103: Windows PowerShell 5.1 and no JSON reader accepts that. ... L107: # Package for an MDM profile (API-key fleet): L108: anyray-connect managed --print --gateway https://gw.acme.com --team eng > managed-settings.json L109: ... L351: const hint = (msg) => { L352: process.stderr.write(`${msg}\n`); L353: };

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/commands/managed.jsView on unpkg · L56

56${bold('Modes')} (pick one) L57: --print Emit the managed-settings JSON to stdout for MDM packaging L58: (Jamf profile, Ansible template, etc.). Writes nothing unless ... L101: (UTF-8, no BOM). Prefer it over a shell redirect when L102: packaging from PowerShell, where \`>\` writes UTF-16LE on L103: Windows PowerShell 5.1 and no JSON reader accepts that. ... L107: # Package for an MDM profile (API-key fleet): L108: anyray-connect managed --print --gateway https://gw.acme.com --team eng > managed-settings.json L109: ... L351: const hint = (msg) => { L352: process.stderr.write(`${msg}\n`); L353: };

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/managed.jsView on unpkg · L56

dist/util/copilotSeatToken.jsView file

26*/ L27: import { execFile } from 'node:child_process'; L28: import { readFile } from 'node:fs/promises'; ... L35: const COPILOT_CLI_KEYCHAIN_SERVICE = 'CopilotCLI'; L36: const COPILOT_ACCESS_PROBE_URL = 'https://api.github.com/copilot_internal/user'; L37: /** ... L44: const isPlainObject = (v) => typeof v === 'object' && v !== null && !Array.isArray(v); L45: const configHome = () => process.env.XDG_CONFIG_HOME?.trim() || join(homedir(), '.config'); L46: const dataHome = () => process.env.XDG_DATA_HOME?.trim() || join(homedir(), '.local', 'share'); ... L51: * token-free). NOT parsed as JSON: the CLI writes a `//` comment banner above L52: * the document ("This file is managed automatically."), so `JSON.parse` L53: * throws on the real file — the first ship of this source missed a cl

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/util/copilotSeatToken.jsView on unpkg · L26

•matchType = previous_version_dangerous_delta matchedPackage = anyray-connect@0.11.91 matchedIdentity = npm:YW55cmF5LWNvbm5lY3Q:0.11.91 similarity = 0.817 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/util/copilotSeatToken.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/commands/managed.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/commands/managed.jsView on unpkg · L56

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/managed.jsView on unpkg · L56

dist/util/copilotSeatToken.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/util/copilotSeatToken.jsView on unpkg · L26

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/util/copilotSeatToken.jsView on unpkg

Findings

2 Critical1 High4 Medium5 Low

CriticalCredential Exfiltrationdist/util/copilotSeatToken.js

CriticalPrevious Version Dangerous Deltadist/util/copilotSeatToken.js

HighTrigger Reachable Persistencedist/commands/managed.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/commands/managed.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to anyray-connect@0.11.101.

The versions list below shows the verdict for each recorded version.

Avoid installing anyray-connect@0.11.101. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-04 12:37:19.481Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

130 known versions

Showing the 101 most recent of 130 known versions.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Related packages

Other credential exfiltration packages

Source & flagged code