Loading npm security reports…

anyray-connect@0.11.101: Malicious npm security report (Block) | LPM Firewall

registry / anyray-connect / 0.11.101

anyray-connect@0.11.101

Anyray connect — points local coding tools (Claude Code, Cursor, Windsurf, SDKs) at the Anyray gateway through supported configuration and enrolled personal authentication.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

A normal apply can automatically harvest existing Copilot OAuth credentials from other tools and persist them for gateway-routed Copilot traffic. The token is also transmitted to GitHub for probing.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs the normal anyray-connect apply flow; copilot-cli is an automatic adapter.

Impact

Existing GitHub Copilot credentials can be repurposed and exposed to the configured gateway.

Mechanism

Credential harvesting, validation, persistence, and gateway forwarding

Attack narrative

On a normal apply, the automatic copilot-cli adapter searches Copilot and OpenCode credential stores for OAuth tokens, probes them with GitHub, then writes a discovered token to an Anyray-owned credential file and configures Copilot CLI to use a gateway lane. This repurposes credentials belonging to separate applications without requiring explicit selection of the adapter on non-macOS systems.

Rationale

Source confirms credential harvesting from third-party application stores, automatic reachability from the main apply path, persistence, and use in gateway-routed traffic. The absence of an npm install hook does not remove the concrete runtime credential-exfiltration chain.

Evidence

package.jsondist/tools/index.jsdist/util/copilotSeatToken.jsdist/tools/copilotCli.jsdist/cli.js~/.copilot/config.json~/.config/github-copilot/apps.json~/.config/github-copilot/hosts.json~/.local/share/opencode/auth.json

Source & flagged code

4 flagged · loading source

dist/commands/managed.jsView file

56Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/cli.js -> dist/commands/managed.js L56: ${bold('Modes')} (pick one) L57: --print Emit the managed-settings JSON to stdout for MDM packaging L58: (Jamf profile, Ansible template, etc.). Writes nothing unless ... L101: (UTF-8, no BOM). Prefer it over a shell redirect when L102: packaging from PowerShell, where \`>\` writes UTF-16LE on L103: Windows PowerShell 5.1 and no JSON reader accepts that. ... L107: # Package for an MDM profile (API-key fleet): L108: anyray-connect managed --print --gateway https://gw.acme.com --team eng > managed-settings.json L109: ... L351: const hint = (msg) => { L352: process.stderr.write(`${msg}\n`); L353: };

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/commands/managed.jsView on unpkg · L56

56${bold('Modes')} (pick one) L57: --print Emit the managed-settings JSON to stdout for MDM packaging L58: (Jamf profile, Ansible template, etc.). Writes nothing unless ... L101: (UTF-8, no BOM). Prefer it over a shell redirect when L102: packaging from PowerShell, where \`>\` writes UTF-16LE on L103: Windows PowerShell 5.1 and no JSON reader accepts that. ... L107: # Package for an MDM profile (API-key fleet): L108: anyray-connect managed --print --gateway https://gw.acme.com --team eng > managed-settings.json L109: ... L351: const hint = (msg) => { L352: process.stderr.write(`${msg}\n`); L353: };

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/managed.jsView on unpkg · L56

dist/util/copilotSeatToken.jsView file

26*/ L27: import { execFile } from 'node:child_process'; L28: import { readFile } from 'node:fs/promises'; ... L35: const COPILOT_CLI_KEYCHAIN_SERVICE = 'CopilotCLI'; L36: const COPILOT_ACCESS_PROBE_URL = 'https://api.github.com/copilot_internal/user'; L37: /** ... L44: const isPlainObject = (v) => typeof v === 'object' && v !== null && !Array.isArray(v); L45: const configHome = () => process.env.XDG_CONFIG_HOME?.trim() || join(homedir(), '.config'); L46: const dataHome = () => process.env.XDG_DATA_HOME?.trim() || join(homedir(), '.local', 'share'); ... L51: * token-free). NOT parsed as JSON: the CLI writes a `//` comment banner above L52: * the document ("This file is managed automatically."), so `JSON.parse` L53: * throws on the real file — the first ship of this source missed a cl

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/util/copilotSeatToken.jsView on unpkg · L26

•matchType = previous_version_dangerous_delta matchedPackage = anyray-connect@0.11.91 matchedIdentity = npm:YW55cmF5LWNvbm5lY3Q:0.11.91 similarity = 0.817 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/util/copilotSeatToken.jsView on unpkg

Source & flagged code

4 flagged

dist/commands/managed.jsView file

Lines 36-76javascript

36import { resolveTarget } from '../target.js';

37import { CLAUDE_CODE_OWNED_ENV_KEYS, buildClaudeCodeEnv, } from '../tools/claudeCodeEnv.js';

38import { buildHookCommand, buildHookEntry, removeAnyrayHookEntries, } from '../tools/claudeCodeHooks.js';

39import { HOOK_FLAG, PROMPT_HOOK_FLAG, hookBinaryIsDurable, hookBinaryPath, } from '../tools/sharedHooks.js';

40import { parseSsoLink } from '../util/ssoEnroll.js';

41import { buildFleetBootstrap, fleetBootstrapPath, } from '../util/fleetBootstrap.js';

42import { buildPlist, buildSystemdUnit, DEFAULT_LOOPBACK_PORT, PROXY_FLAG, } from '../util/proxyService.js';

43import { ACP_AGENT_FLAG, CLAUDE_ACP_NAME, CODEX_ACP_NAME, isSafeNpxCommand, } from '../tools/acpAgents.js';

44import { shSingleQuote } from '../tools/shellEnv.js';

45import { metadataHeaderValue } from '../types.js';

46import { bold, dim, fail, info, ok, warn } from '../util/log.js';

47const MANAGED_HELP = `${bold('anyray-connect managed')} — fleet-wide Claude Code routing via managed-settings.json

48

49Emit or install the OS \`managed-settings.json\` that points a managed fleet's

50Claude Code at the Anyray gateway. It reads at a HIGHER precedence than a user's

51\`~/.claude/settings.json\`, so it survives users editing or wiping their own

52settings. The managed file removes per-dev routing edits, but no credential is

53ever written to it: each user still needs one enrollment/bootstrap so the

54gateway can attribute and authenticate their requests.

55

56${bold('Modes')} (pick one)

57 --print Emit the managed-settings JSON to stdout for MDM packaging

58 (Jamf profile, Ansible template, etc.). Writes nothing unless

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/commands/managed.jsView on unpkg · L56

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/managed.jsView on unpkg · L56

59 --out names a file.

60 --write Write it to the OS system path (merging into any existing file,

61 preserving non-Anyray keys). Requires root (sudo).

62 --revert Remove only the Anyray-owned keys from the system file.

63

64${bold('Options')}

65 --tool <id> Which fleet artifact to emit (default claude-code):

66 claude-code the managed-settings.json described above

67 jetbrains acp.json registering the Anyray ACP agents

68 (--print only; needs --bin and --npx; takes

69 no gateway/attribution — everything resolves

70 from each user's own enrollment at launch)

71 shell /etc/profile.d snippet exporting the gateway

72 base URLs only (--print only; never a key)

73 bootstrap content-free fleet bootstrap file carrying

74 the org SSO link (--print only; needs --sso;

75 read by deferred-enrollment surfaces on

76 machines whose dev never ran Connect)

dist/util/copilotSeatToken.jsView file

Lines 6-46javascript

6 *

7 * Verified 2026-07-27 against GitHub's Copilot API: `api.githubcopilot.com`

8 * accepts the device-login OAuth token directly as `Authorization: Bearer` —

9 *