Loading npm security reports…

anyray-connect@0.11.102: Suspicious npm security report (Warn) | LPM Firewall

registry / anyray-connect / 0.11.102

anyray-connect@0.11.102

Anyray connect — points local coding tools (Claude Code, Cursor, Windsurf, SDKs) at the Anyray gateway through supported configuration and enrolled personal authentication.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

A default user-invoked apply can discover GitHub Copilot OAuth credentials and route Copilot traffic through an Anyray gateway. Installed hooks can also upload tool inputs and outputs to that gateway for optimization.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Running anyray-connect apply/default flow when Copilot CLI is detected, then using configured AI tools.

Impact

Third-party OAuth credentials and AI tool content are exposed to the configured gateway; shell/MCP configuration persists the route.

Mechanism

OAuth credential harvesting, persistent AI-tool rerouting, and gateway upload hooks.

Rationale

The source implements cross-application OAuth token acquisition and forwards that token through a third-party gateway after persistent configuration changes. The absence of install-time execution reduces severity but does not remove the concrete credential-exfiltration behavior activated by the default CLI flow. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.

Evidence

package.jsondist/cli.jsdist/util/copilotSeatToken.jsdist/tools/copilotCli.jsdist/commands/hook.js~/.copilot/config.json~/.config/github-copilot/apps.json~/.config/github-copilot/hosts.json~/.local/share/opencode/auth.jsonmacOS Keychain: CopilotCLI~/.anyray/copilot-cli.shshell profile

Source & flagged code

8 flagged · loading source

dist/commands/managed.jsView file

56Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/cli.js -> dist/commands/managed.js L56: ${bold('Modes')} (pick one) L57: --print Emit the managed-settings JSON to stdout for MDM packaging L58: (Jamf profile, Ansible template, etc.). Writes nothing unless ... L101: (UTF-8, no BOM). Prefer it over a shell redirect when L102: packaging from PowerShell, where \`>\` writes UTF-16LE on L103: Windows PowerShell 5.1 and no JSON reader accepts that. ... L107: # Package for an MDM profile (API-key fleet): L108: anyray-connect managed --print --gateway https://gw.acme.com --team eng > managed-settings.json L109: ... L351: const hint = (msg) => { L352: process.stderr.write(`${msg}\n`); L353: };

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/commands/managed.jsView on unpkg · L56

56${bold('Modes')} (pick one) L57: --print Emit the managed-settings JSON to stdout for MDM packaging L58: (Jamf profile, Ansible template, etc.). Writes nothing unless ... L101: (UTF-8, no BOM). Prefer it over a shell redirect when L102: packaging from PowerShell, where \`>\` writes UTF-16LE on L103: Windows PowerShell 5.1 and no JSON reader accepts that. ... L107: # Package for an MDM profile (API-key fleet): L108: anyray-connect managed --print --gateway https://gw.acme.com --team eng > managed-settings.json L109: ... L351: const hint = (msg) => { L352: process.stderr.write(`${msg}\n`); L353: };

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/managed.jsView on unpkg · L56

dist/util/copilotSeatToken.jsView file

26*/ L27: import { execFile } from 'node:child_process'; L28: import { readFile } from 'node:fs/promises'; ... L35: const COPILOT_CLI_KEYCHAIN_SERVICE = 'CopilotCLI'; L36: const COPILOT_ACCESS_PROBE_URL = 'https://api.github.com/copilot_internal/user'; L37: /** ... L44: const isPlainObject = (v) => typeof v === 'object' && v !== null && !Array.isArray(v); L45: const configHome = () => process.env.XDG_CONFIG_HOME?.trim() || join(homedir(), '.config'); L46: const dataHome = () => process.env.XDG_DATA_HOME?.trim() || join(homedir(), '.local', 'share'); ... L51: * token-free). NOT parsed as JSON: the CLI writes a `//` comment banner above L52: * the document ("This file is managed automatically."), so `JSON.parse` L53: * throws on the real file — the first ship of this source missed a cl

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/util/copilotSeatToken.jsView on unpkg · L26

dist/commands/acpAgent.jsView file

•matchType = normalized_sha256 matchedPackage = anyray-connect@0.11.101 matchedPath = dist/commands/acpAgent.js matchedIdentity = npm:YW55cmF5LWNvbm5lY3Q:0.11.101 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/acpAgent.jsView on unpkg

dist/util/devRefresh.jsView file

•matchType = normalized_sha256 matchedPackage = anyray-connect@0.11.101 matchedPath = dist/util/devRefresh.js matchedIdentity = npm:YW55cmF5LWNvbm5lY3Q:0.11.101 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/util/devRefresh.jsView on unpkg

dist/util/selfUpdate.jsView file

•matchType = normalized_sha256 matchedPackage = anyray-connect@0.11.101 matchedPath = dist/util/selfUpdate.js matchedIdentity = npm:YW55cmF5LWNvbm5lY3Q:0.11.101 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/util/selfUpdate.jsView on unpkg

dist/util/vscodeExtension.jsView file

•matchType = normalized_sha256 matchedPackage = anyray-connect@0.11.101 matchedPath = dist/util/vscodeExtension.js matchedIdentity = npm:YW55cmF5LWNvbm5lY3Q:0.11.101 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/util/vscodeExtension.jsView on unpkg

dist/tools/claudeDesktop.jsView file

•matchType = normalized_sha256 matchedPackage = anyray-connect@0.11.101 matchedPath = dist/tools/claudeDesktop.js matchedIdentity = npm:YW55cmF5LWNvbm5lY3Q:0.11.101 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/claudeDesktop.jsView on unpkg

Source & flagged code

8 flagged

dist/commands/managed.jsView file

Lines 36-76javascript

36import { resolveTarget } from '../target.js';

37import { CLAUDE_CODE_OWNED_ENV_KEYS, buildClaudeCodeEnv, } from '../tools/claudeCodeEnv.js';

38import { buildHookCommand, buildHookEntry, removeAnyrayHookEntries, } from '../tools/claudeCodeHooks.js';

39import { HOOK_FLAG, PROMPT_HOOK_FLAG, hookBinaryIsDurable, hookBinaryPath, } from '../tools/sharedHooks.js';

40import { parseSsoLink } from '../util/ssoEnroll.js';

41import { buildFleetBootstrap, fleetBootstrapPath, } from '../util/fleetBootstrap.js';

42import { buildPlist, buildSystemdUnit, DEFAULT_LOOPBACK_PORT, PROXY_FLAG, } from '../util/proxyService.js';

43import { ACP_AGENT_FLAG, CLAUDE_ACP_NAME, CODEX_ACP_NAME, isSafeNpxCommand, } from '../tools/acpAgents.js';

44import { shSingleQuote } from '../tools/shellEnv.js';

45import { metadataHeaderValue } from '../types.js';

46import { bold, dim, fail, info, ok, warn } from '../util/log.js';

47const MANAGED_HELP = `${bold('anyray-connect managed')} — fleet-wide Claude Code routing via managed-settings.json

48

49Emit or install the OS \`managed-settings.json\` that points a managed fleet's

50Claude Code at the Anyray gateway. It reads at a HIGHER precedence than a user's

51\`~/.claude/settings.json\`, so it survives users editing or wiping their own

52settings. The managed file removes per-dev routing edits, but no credential is

53ever written to it: each user still needs one enrollment/bootstrap so the

54gateway can attribute and authenticate their requests.

55

56${bold('Modes')} (pick one)

57 --print Emit the managed-settings JSON to stdout for MDM packaging

58 (Jamf profile, Ansible template, etc.). Writes nothing unless

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/commands/managed.jsView on unpkg · L56

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/managed.jsView on unpkg · L56

59 --out names a file.

60 --write Write it to the OS system path (merging into any existing file,

61 preserving non-Anyray keys). Requires root (sudo).

62 --revert Remove only the Anyray-owned keys from the system file.

63

64${bold('Options')}

65 --tool <id> Which fleet artifact to emit (default claude-code):

66 claude-code the managed-settings.json described above

67 jetbrains acp.json registering the Anyray ACP agents

68 (--print only; needs --bin and --npx; takes

69 no gateway/attribution — everything resolves

70 from each user's own enrollment at launch)

71 shell /etc/profile.d snippet exporting the gateway

72 base URLs only (--print only; never a key)

73 bootstrap content-free fleet bootstrap file carrying

74 the org SSO link (--print only; needs --sso;

75 read by deferred-enrollment surfaces on

76 machines whose dev never ran Connect)

dist/util/copilotSeatToken.jsView file

Lines 6-46javascript

6 *

7 * Verified 2026-07-27 against GitHub's Copilot API: `api.githubcopilot.com`

8 * accepts the device-login OAuth token directly as `Authorization: Bearer` —

9 *

dist/commands/acpAgent.jsView file

•matchType = normalized_sha256 matchedPackage = anyray-connect@0.11.101 matchedPath = dist/commands/acpAgent.js matchedIdentity = npm:YW55cmF5LWNvbm5lY3Q:0.11.101 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/acpAgent.jsView on unpkg

dist/util/devRefresh.jsView file

•matchType = normalized_sha256 matchedPackage = anyray-connect@0.11.101 matchedPath = dist/util/devRefresh.js matchedIdentity = npm:YW55cmF5LWNvbm5lY3Q:0.11.101 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/util/devRefresh.jsView on unpkg

dist/util/selfUpdate.jsView file

•matchType = normalized_sha256 matchedPackage = anyray-connect@0.11.101 matchedPath = dist/util/selfUpdate.js matchedIdentity = npm:YW55cmF5LWNvbm5lY3Q:0.11.101 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/util/selfUpdate.jsView on unpkg

dist/util/vscodeExtension.jsView file

•matchType = normalized_sha256 matchedPackage = anyray-connect@0.11.101 matchedPath = dist/util/vscodeExtension.js matchedIdentity = npm:YW55cmF5LWNvbm5lY3Q:0.11.101 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/util/vscodeExtension.jsView on unpkg

dist/tools/claudeDesktop.jsView file

•matchType = normalized_sha256 matchedPackage = anyray-connect@0.11.101 matchedPath = dist/tools/claudeDesktop.js matchedIdentity = npm:YW55cmF5LWNvbm5lY3Q:0.11.101 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools/claudeDesktop.jsView on unpkg