anyray-connect@0.11.157
Anyray connect — points local coding tools (Claude Code, Cursor, Windsurf, SDKs) at the Anyray gateway through supported configuration and enrolled personal authentication.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe scanner's malicious conclusion overstates the source evidence: the capabilities are user-command-driven and there is no npm install hook. The package still warrants a warning because it intentionally modifies AI-client control surfaces and establishes background refresh persistence.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs anyray-connect configuration/enrollment commands.
Impact
Can reroute configured AI-client traffic and persist a key-refresh helper under the user's account.
Mechanism
Explicit CLI-driven AI-client routing configuration and per-user service setup.
AI rationale
The scanner's malicious conclusion overstates the source evidence: the capabilities are user-command-driven and there is no npm install hook. The package still warrants a warning because it intentionally modifies AI-client control surfaces and establishes background refresh persistence.
Evidence
package.jsondist/index.jsREADME.md~/.codex/config.toml~/.codex/hooks.json~/Library/LaunchAgents~/.config/systemd/user
Network endpoints1
chatgpt.com/backend-api/codex
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- User-invoked CLI targets Codex config.toml and hooks.json.
- Runtime creates per-user launchd/systemd key-refresh services.
- Runtime installs a bundled VS Code extension when configured.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Observed changes are reached through the declared CLI, not package installation.
- No confirmed stealthy exfiltration, remote payload execution, or destructive behavior in inspected files.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
11 flagged · loading sourcedist/index.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: var UR="http://localhost:8787",as="anyray-placeholder",xe=e=>{let t=e?.trim();return!!(t&&/^ark_[A-Za-z0-9_-]{20,512}$/.test(t))},Je=e=>{let t=e.trim().replace(/\/+$/,"");return t=...
L3: `;if(a||n.tombstoneAbsent!==!1)try{await xg(r,s)}catch(i){if(i.code!=="EEXIST")throw i}}let o=`${e}.anyray-tmp-${process.pid}-${Tg()}`;try{await xg(o,`${JSON.stringify(t,null,2)}
...
L5: `,{mode:384})}catch(a){throw await Hr(e,{recursive:!0,force:!0}).catch(()=>{}),a}return async()=>{try{JSON.parse(await cs(t,"utf-8")).nonce===r&&await Hr(e,{recursive:!0,force:!0})...
L6: `,{mode:384}),await Uu(r,384);try{await he(r,n)}catch(o){throw await Hr(r,{force:!0}).catch(()=>{}),o}},oe=async e=>{let t=await Hg
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L11#!/usr/bin/env node
L2: var UR="http://localhost:8787",as="anyray-placeholder",xe=e=>{let t=e?.trim();return!!(t&&/^ark_[A-Za-z0-9_-]{20,512}$/.test(t))},Je=e=>{let t=e.trim().replace(/\/+$/,"");return t=...
L3: `;if(a||n.tombstoneAbsent!==!1)try{await xg(r,s)}catch(i){if(i.code!=="EEXIST")throw i}}let o=`${e}.anyray-tmp-${process.pid}-${Tg()}`;try{await xg(o,`${JSON.stringify(t,null,2)}
High
119`).map(LD).join(" + [Environment]::NewLine + "),ND=(e={})=>{let t={...TD,...e},n=()=>t.platform()==="win32",r=async()=>{let i=(await al(vt(),An))?.find(c=>c.startsWith("export COPI...
L120: `)):Z&&q&&await ei($,{force:!0}),await ol(c,Y,An)}catch(Le){try{W!==void 0&&q?await pe($,W):q&&await ei($,{force:!0})}catch{throw new Error("Copilot CLI environment update failed a...
L121: import { spawn } from "node:child_process"
High
1#!/usr/bin/env node
L2: var UR="http://localhost:8787",as="anyray-placeholder",xe=e=>{let t=e?.trim();return!!(t&&/^ark_[A-Za-z0-9_-]{20,512}$/.test(t))},Je=e=>{let t=e.trim().replace(/\/+$/,"");return t=...
L3: `;if(a||n.tombstoneAbsent!==!1)try{await xg(r,s)}catch(i){if(i.code!=="EEXIST")throw i}}let o=`${e}.anyray-tmp-${process.pid}-${Tg()}`;try{await xg(o,`${JSON.stringify(t,null,2)}
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L1•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
var UR="http://localhost:8787",as="anyray-placeholder",xe=e=>{let t=e?.trim();return!!(t&&/^ark_[A-Za-z0-9_-]{20,512}$/.test(t))},Je=e=>{let t=e.trim().replace(/\/+$/,"");return t=...
`),await he(o,e),await YR(e,384),await zR(e)}finally{await zt(o,{force:!0}).catch(()=>{})}},Dg=1,Rg=3e4,qR=5e3,QR=/^[a-f0-9]{64}$/,Ng=e=>`${e}.pending`,eO=e=>`${e}.lock`,Lu=e=>{if(...
`)},fn=(e,t={})=>{let n=e.byoUpstream,r=!n&&X(e,"anthropic"),o=de({...e.metadata,tool:e.metadata.tool??"claude-code"}),a=t.includeClientKey!==!1&&!((r||n)&&e.viaLocalProxy),s=t.inc...
`)){let u=d.indexOf(":");if(u>0&&d.slice(0,u).trim().toLowerCase()===l)retur
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/index.js:
var UR="http://localhost:8787",as="anyray-placeholder",xe=e=>{let t=e?.trim();return!!(t&&/^ark_[A-Za-z0-9_-]{20,512}$/.test(t))},Je=e=>{let t=e.trim().replace(/\/+$/,"");return t=...
`),await he(o,e),await YR(e,384),await zR(e)}finally{await zt(o,{force:!0}).catch(()=>{})}},Dg=1,Rg=3e4,qR=5e3,QR=/^[a-f0-9]{64}$/,Ng=e=>`${e}.pending`,eO=e=>`${e}.lock`,Lu=e=>{if(...
`,{mode:384}),await Uu(r,384);try{await he(r,n)}catch(o){throw await Hr(r,{force:!0}).catch(()=>{}),o}},oe=async e=>{let t=await Hg();try{await Gg(e)}finally{await t()}},Kg=async e...
`},Mc=()=>{let{command:e,args:t}=up();return["Auto-start is not wired for this OS. Run the key-re
High
Entrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/index.jsView on unpkg97`),!0):!1};var Mt=e=>{if(e.length<=4)return"\u2026";let t=/^([a-z0-9]{2,6}_)/i.exec(e)?.[1]??"";return e.length>t.length+4?`${t}\u2026${e.slice(-4)}`:`\u2026${e.slice(-4)}`};var Se...
L98: `)):w&&g&&await Fp(d,{force:!0}),await ol(n,f)}catch(b){try{y!==void 0&&g?await pe(d,y):g&&await Fp(d,{force:!0})}catch{throw new Error("shell environment update failed and credent...
L99: `)?a.slice(0,-2):a.endsWith(`
...
L104: `);cl("sqlite3",[e],{input:o,encoding:"utf-8",maxBuffer:Kp,stdio:["pipe","ignore","pipe"]})}finally{try{hP(n,{recursive:!0,force:!0})}catch{}}},AP={kind:"sqlite3-cli",readItem:(e,t...
L105: `,{mode:384}),await he(n,t)},MP=(e,t)=>e.generation||t.generation?!!(e.generation&&e.generation===t.generation):e.op===t.op&&e.requestedAt===t.requestedAt&&e.watcherPid===t.watcher...
L10
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L9797Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js
L97: `),!0):!1};var Mt=e=>{if(e.length<=4)return"\u2026";let t=/^([a-z0-9]{2,6}_)/i.exec(e)?.[1]??"";return e.length>t.length+4?`${t}\u2026${e.slice(-4)}`:`\u2026${e.slice(-4)}`};var Se...
L98: `)):w&&g&&await Fp(d,{force:!0}),await ol(n,f)}catch(b){try{y!==void 0&&g?await pe(d,y):g&&await Fp(d,{force:!0})}catch{throw new Error("shell environment update failed and credent...
L99: `)?a.slice(0,-2):a.endsWith(`
...
L104: `);cl("sqlite3",[e],{input:o,encoding:"utf-8",maxBuffer:Kp,stdio:["pipe","ignore","pipe"]})}finally{try{hP(n,{recursive:!0,force:!0})}catch{}}},AP={kind:"sqlite3-cli",readItem:(e,t...
L105: `,{mode:384}),await he(n,t)},MP=(e,t)=>e.generation||t.generation?!!(e.generation&&e.generation===t.gen
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.jsView on unpkg · L971Trigger-reachable persistence chain: scripts.start -> dist/index.js
L1: #!/usr/bin/env node
L2: var UR="http://localhost:8787",as="anyray-placeholder",xe=e=>{let t=e?.trim();return!!(t&&/^ark_[A-Za-z0-9_-]{20,512}$/.test(t))},Je=e=>{let t=e.trim().replace(/\/+$/,"");return t=...
L3: `;if(a||n.tombstoneAbsent!==!1)try{await xg(r,s)}catch(i){if(i.code!=="EEXIST")throw i}}let o=`${e}.anyray-tmp-${process.pid}-${Tg()}`;try{await xg(o,`${JSON.stringify(t,null,2)}
...
L5: `,{mode:384})}catch(a){throw await Hr(e,{recursive:!0,force:!0}).catch(()=>{}),a}return async()=>{try{JSON.parse(await cs(t,"utf-8")).nonce===r&&await Hr(e,{recursive:!0,force:!0})...
L6: `,{mode:384}),await Uu(r,384);try{await he(r,n)}catch(o){throw await Hr(r,{force:!0}).catch(()=>{}),o}},oe=async e=>{let t=await Hg();try{awa
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/index.jsView on unpkg · L11#!/usr/bin/env node
L2: var UR="http://localhost:8787",as="anyray-placeholder",xe=e=>{let t=e?.trim();return!!(t&&/^ark_[A-Za-z0-9_-]{20,512}$/.test(t))},Je=e=>{let t=e.trim().replace(/\/+$/,"");return t=...
L3: `;if(a||n.tombstoneAbsent!==!1)try{await xg(r,s)}catch(i){if(i.code!=="EEXIST")throw i}}let o=`${e}.anyray-tmp-${process.pid}-${Tg()}`;try{await xg(o,`${JSON.stringify(t,null,2)}
...
L5: `,{mode:384})}catch(a){throw await Hr(e,{recursive:!0,force:!0}).catch(()=>{}),a}return async()=>{try{JSON.parse(await cs(t,"utf-8")).nonce===r&&await Hr(e,{recursive:!0,force:!0})...
L6: `,{mode:384}),await Uu(r,384);try{await he(r,n)}catch(o){throw await Hr(r,{force:!0}).catch(()=>{}),o}},oe=async e=>{let t=await Hg();try{await Gg(e)}finally{await t()}},Kg=async e...
L7: `)},fn=(e,t={})=>{let
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/index.jsView on unpkg · L11#!/usr/bin/env node
L2: var UR="http://localhost:8787",as="anyray-placeholder",xe=e=>{let t=e?.trim();return!!(t&&/^ark_[A-Za-z0-9_-]{20,512}$/.test(t))},Je=e=>{let t=e.trim().replace(/\/+$/,"");return t=...
L3: `;if(a||n.tombstoneAbsent!==!1)try{await xg(r,s)}catch(i){if(i.code!=="EEXIST")throw i}}let o=`${e}.anyray-tmp-${process.pid}-${Tg()}`;try{await xg(o,`${JSON.stringify(t,null,2)}
...
L5: `,{mode:384})}catch(a){throw await Hr(e,{recursive:!0,force:!0}).catch(()=>{}),a}return async()=>{try{JSON.parse(await cs(t,"utf-8")).nonce===r&&await Hr(e,{recursive:!0,force:!0})...
L6: `,{mode:384}),await Uu(r,384);try{await he(r,n)}catch(o){throw await Hr(r,{force:!0}).catch(()=>{}),o}},oe=async e=>{let t=await Hg();try{await Gg(e)}finally{await t()}},Kg=async e...
L7: `)},fn=(e,t={})=>{let
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/index.jsView on unpkg · L1Findings
1 Critical9 High4 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighEntrypoint Foreign Package Code Overwritedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighTrigger Reachable Persistencedist/index.js
HighBase64 Obscured Urldist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to anyray-connect@0.11.157.
See all versions of anyray-connect for other recorded verdicts.
- Review the evidence and your use of anyray-connect@0.11.157 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.