registry / anyray-connect / 0.11.156
anyray-connect@0.11.156
Anyray connect — points local coding tools (Claude Code, Cursor, Windsurf, SDKs) at the Anyray gateway through supported configuration and enrolled personal authentication.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiDirect inspection shows a feature-rich but explicitly invoked CLI for configuring Anyray gateway integration. There are no npm install lifecycle hooks or source facts establishing covert exfiltration, remote payload execution, or unconsented agent-control mutation.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs the anyray-connect CLI and confirms setup or supplies --yes.
Impact
Changes are documented configuration behavior, not unconsented install-time execution.
Mechanism
User-invoked gateway routing and managed tool configuration.
AI rationale
Direct inspection shows a feature-rich but explicitly invoked CLI for configuring Anyray gateway integration. There are no npm install lifecycle hooks or source facts establishing covert exfiltration, remote payload execution, or unconsented agent-control mutation.
Evidence
package.jsonREADME.mddist/index.js
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- dist/index.js is a CLI entrypoint invoked through the declared bin.
- Configuration changes require explicit CLI application and enrollment/confirmation.
- Network routing targets a user-supplied Anyray gateway; default is localhost.
- README documents scoped, reversible configuration of supported developer tools.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
10 flagged · loading sourcedist/index.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: var NR="http://localhost:8787",as="anyray-placeholder",Ie=e=>{let t=e?.trim();return!!(t&&/^ark_[A-Za-z0-9_-]{20,512}$/.test(t))},Je=e=>{let t=e.trim().replace(/\/+$/,"");return t=...
L3: `;if(a||n.tombstoneAbsent!==!1)try{await vg(r,s)}catch(i){if(i.code!=="EEXIST")throw i}}let o=`${e}.anyray-tmp-${process.pid}-${Rg()}`;try{await vg(o,`${JSON.stringify(t,null,2)}
...
L5: `,{mode:384})}catch(a){throw await Wr(e,{recursive:!0,force:!0}).catch(()=>{}),a}return async()=>{try{JSON.parse(await cs(t,"utf-8")).nonce===r&&await Wr(e,{recursive:!0,force:!0})...
L6: `,{mode:384}),await Uu(r,384);try{await he(r,n)}catch(o){throw await Wr(r,{force:!0}).catch(()=>{}),o}},oe=async e=>{let t=await Bg
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L11#!/usr/bin/env node
L2: var NR="http://localhost:8787",as="anyray-placeholder",Ie=e=>{let t=e?.trim();return!!(t&&/^ark_[A-Za-z0-9_-]{20,512}$/.test(t))},Je=e=>{let t=e.trim().replace(/\/+$/,"");return t=...
L3: `;if(a||n.tombstoneAbsent!==!1)try{await vg(r,s)}catch(i){if(i.code!=="EEXIST")throw i}}let o=`${e}.anyray-tmp-${process.pid}-${Rg()}`;try{await vg(o,`${JSON.stringify(t,null,2)}
High
119`).map(RD).join(" + [Environment]::NewLine + "),_D=(e={})=>{let t={...xD,...e},n=()=>t.platform()==="win32",r=async()=>{let i=(await ol(vt(),An))?.find(c=>c.startsWith("export COPI...
L120: `)):Z&&q&&await ei($,{force:!0}),await rl(c,Y,An)}catch(Le){try{W!==void 0&&q?await pe($,W):q&&await ei($,{force:!0})}catch{throw new Error("Copilot CLI environment update failed a...
L121: import { spawn } from "node:child_process"
High
1#!/usr/bin/env node
L2: var NR="http://localhost:8787",as="anyray-placeholder",Ie=e=>{let t=e?.trim();return!!(t&&/^ark_[A-Za-z0-9_-]{20,512}$/.test(t))},Je=e=>{let t=e.trim().replace(/\/+$/,"");return t=...
L3: `;if(a||n.tombstoneAbsent!==!1)try{await vg(r,s)}catch(i){if(i.code!=="EEXIST")throw i}}let o=`${e}.anyray-tmp-${process.pid}-${Rg()}`;try{await vg(o,`${JSON.stringify(t,null,2)}
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L1•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
var NR="http://localhost:8787",as="anyray-placeholder",Ie=e=>{let t=e?.trim();return!!(t&&/^ark_[A-Za-z0-9_-]{20,512}$/.test(t))},Je=e=>{let t=e.trim().replace(/\/+$/,"");return t=...
`),await he(o,e),await HR(e,384),await jR(e)}finally{await zt(o,{force:!0}).catch(()=>{})}},_g=1,Sg=3e4,YR=5e3,ZR=/^[a-f0-9]{64}$/,Pg=e=>`${e}.pending`,JR=e=>`${e}.lock`,Lu=e=>{if(...
`)},fn=(e,t={})=>{let n=e.byoUpstream,r=!n&&X(e,"anthropic"),o=de({...e.metadata,tool:e.metadata.tool??"claude-code"}),a=t.includeClientKey!==!1&&!((r||n)&&e.viaLocalProxy),s=t.inc...
`)){let u=d.indexOf(":");if(u>0&&d.slice(0,u).trim().toLowerCase()===l)retur
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg97`),!0):!1};var Mt=e=>{if(e.length<=4)return"\u2026";let t=/^([a-z0-9]{2,6}_)/i.exec(e)?.[1]??"";return e.length>t.length+4?`${t}\u2026${e.slice(-4)}`:`\u2026${e.slice(-4)}`};var ve...
L98: `)):w&&y&&await Fp(d,{force:!0}),await rl(n,f)}catch(b){try{g!==void 0&&y?await pe(d,g):y&&await Fp(d,{force:!0})}catch{throw new Error("shell environment update failed and credent...
L99: `)?a.slice(0,-2):a.endsWith(`
...
L104: `);il("sqlite3",[e],{input:o,encoding:"utf-8",maxBuffer:Kp,stdio:["pipe","ignore","pipe"]})}finally{try{lP(n,{recursive:!0,force:!0})}catch{}}},gP={kind:"sqlite3-cli",readItem:(e,t...
L105: `,{mode:384}),await he(n,t)},TP=(e,t)=>e.generation||t.generation?!!(e.generation&&e.generation===t.generation):e.op===t.op&&e.requestedAt===t.requestedAt&&e.watcherPid===t.watcher...
L10
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L9797Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js
L97: `),!0):!1};var Mt=e=>{if(e.length<=4)return"\u2026";let t=/^([a-z0-9]{2,6}_)/i.exec(e)?.[1]??"";return e.length>t.length+4?`${t}\u2026${e.slice(-4)}`:`\u2026${e.slice(-4)}`};var ve...
L98: `)):w&&y&&await Fp(d,{force:!0}),await rl(n,f)}catch(b){try{g!==void 0&&y?await pe(d,g):y&&await Fp(d,{force:!0})}catch{throw new Error("shell environment update failed and credent...
L99: `)?a.slice(0,-2):a.endsWith(`
...
L104: `);il("sqlite3",[e],{input:o,encoding:"utf-8",maxBuffer:Kp,stdio:["pipe","ignore","pipe"]})}finally{try{lP(n,{recursive:!0,force:!0})}catch{}}},gP={kind:"sqlite3-cli",readItem:(e,t...
L105: `,{mode:384}),await he(n,t)},TP=(e,t)=>e.generation||t.generation?!!(e.generation&&e.generation===t.gen
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.jsView on unpkg · L971Trigger-reachable persistence chain: scripts.start -> dist/index.js
L1: #!/usr/bin/env node
L2: var NR="http://localhost:8787",as="anyray-placeholder",Ie=e=>{let t=e?.trim();return!!(t&&/^ark_[A-Za-z0-9_-]{20,512}$/.test(t))},Je=e=>{let t=e.trim().replace(/\/+$/,"");return t=...
L3: `;if(a||n.tombstoneAbsent!==!1)try{await vg(r,s)}catch(i){if(i.code!=="EEXIST")throw i}}let o=`${e}.anyray-tmp-${process.pid}-${Rg()}`;try{await vg(o,`${JSON.stringify(t,null,2)}
...
L5: `,{mode:384})}catch(a){throw await Wr(e,{recursive:!0,force:!0}).catch(()=>{}),a}return async()=>{try{JSON.parse(await cs(t,"utf-8")).nonce===r&&await Wr(e,{recursive:!0,force:!0})...
L6: `,{mode:384}),await Uu(r,384);try{await he(r,n)}catch(o){throw await Wr(r,{force:!0}).catch(()=>{}),o}},oe=async e=>{let t=await Bg();try{awa
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/index.jsView on unpkg · L11#!/usr/bin/env node
L2: var NR="http://localhost:8787",as="anyray-placeholder",Ie=e=>{let t=e?.trim();return!!(t&&/^ark_[A-Za-z0-9_-]{20,512}$/.test(t))},Je=e=>{let t=e.trim().replace(/\/+$/,"");return t=...
L3: `;if(a||n.tombstoneAbsent!==!1)try{await vg(r,s)}catch(i){if(i.code!=="EEXIST")throw i}}let o=`${e}.anyray-tmp-${process.pid}-${Rg()}`;try{await vg(o,`${JSON.stringify(t,null,2)}
...
L5: `,{mode:384})}catch(a){throw await Wr(e,{recursive:!0,force:!0}).catch(()=>{}),a}return async()=>{try{JSON.parse(await cs(t,"utf-8")).nonce===r&&await Wr(e,{recursive:!0,force:!0})...
L6: `,{mode:384}),await Uu(r,384);try{await he(r,n)}catch(o){throw await Wr(r,{force:!0}).catch(()=>{}),o}},oe=async e=>{let t=await Bg();try{await Fg(e)}finally{await t()}},Ug=async e...
L7: `)},fn=(e,t={})=>{let
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/index.jsView on unpkg · L11#!/usr/bin/env node
L2: var NR="http://localhost:8787",as="anyray-placeholder",Ie=e=>{let t=e?.trim();return!!(t&&/^ark_[A-Za-z0-9_-]{20,512}$/.test(t))},Je=e=>{let t=e.trim().replace(/\/+$/,"");return t=...
L3: `;if(a||n.tombstoneAbsent!==!1)try{await vg(r,s)}catch(i){if(i.code!=="EEXIST")throw i}}let o=`${e}.anyray-tmp-${process.pid}-${Rg()}`;try{await vg(o,`${JSON.stringify(t,null,2)}
...
L5: `,{mode:384})}catch(a){throw await Wr(e,{recursive:!0,force:!0}).catch(()=>{}),a}return async()=>{try{JSON.parse(await cs(t,"utf-8")).nonce===r&&await Wr(e,{recursive:!0,force:!0})...
L6: `,{mode:384}),await Uu(r,384);try{await he(r,n)}catch(o){throw await Wr(r,{force:!0}).catch(()=>{}),o}},oe=async e=>{let t=await Bg();try{await Fg(e)}finally{await t()}},Ug=async e...
L7: `)},fn=(e,t={})=>{let
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/index.jsView on unpkg · L1Findings
1 Critical8 High4 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighTrigger Reachable Persistencedist/index.js
HighBase64 Obscured Urldist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to anyray-connect@0.11.156.
See all versions of anyray-connect for other recorded verdicts.
- Review the evidence and your use of anyray-connect@0.11.156 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.