anyray-connect@0.11.216
Anyray connect — points local coding tools (Claude Code, Cursor, Windsurf, SDKs) at the Anyray gateway through supported configuration and enrolled personal authentication.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package is not malicious under the install-hook policy because it has no automatic registry lifecycle trigger. Its explicit command can nevertheless remotely configure agent skills and MCP entries, so it warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the CLI, enrolls or supplies a gateway key, and confirms configuration or passes --yes.
Impact
A gateway operator can influence configured AI-agent capabilities on enrolled machines.
Mechanism
Authenticated gateway policy fetch followed by skill and MCP synchronization.
AI rationale
The package is not malicious under the install-hook policy because it has no automatic registry lifecycle trigger. Its explicit command can nevertheless remotely configure agent skills and MCP entries, so it warrants a warning.
Evidence
dist/index.js~/.agents/skills~/.anyray
Network endpoints1
${e}/connect/policy
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The user-invoked CLI fetches an authenticated team policy from the configured gateway.
- That policy is used to synchronize skills and organization MCP configuration.
- The package targets a user-level AI-agent skills directory, creating a remote policy-to-agent configuration path.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The package has no runtime dependency on itself.
- Configuration requires an interactive confirmation unless --yes or dry-run is used.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flagged · loading sourcedist/index.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: var dM=Object.defineProperty;var F=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var cy=(e,t)=>{for(var n in t)dM(e,n,{get:t[n],enumerable:!0})}...
L3: `,{mode:384})}catch(c){throw await Us(e,{recursive:!0,force:!0}).catch(()=>{}),c}return async()=>{try{JSON.parse(await Zc(o,"utf-8")).nonce===s&&await Us(e,{recursive:!0,force:!0})...
L4: `,{mode:384}),await my(r,384);try{await Se(r,n)}catch(o){throw await Us(r,{force:!0}).catch(()=>{}),o}},ke=async e=>{if(vu.getStore()===!0){await py(e);return}let t=await gy();try{...
L5: `;if(a||n.tombstoneAbsent!==!1)try{await Yv(r,s)}catch(i){if(i.code!=="EEXIST")throw i}}let o=`${e}.anyray-tmp-${process.pid}-${eI
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L149`),!0):!1}});var Sn,Ju=F(()=>{"use strict";Sn=e=>{if(e.length<=4)return"\u2026";let t=/^([a-z0-9]{2,6}_)/i.exec(e)?.[1]??"";return e.length>t.length+4?`${t}\u2026${e.slice(-4)}`:`\...
L50: `)):w&&b&&await Uy(d,{force:!0}),await Yu(n,p)}catch(g){try{y!==void 0&&b?await Ee(d,y):b&&await Uy(d,{force:!0})}catch{throw new Error("shell environment update failed and credent...
L51: `)?a.slice(0,-2):a.endsWith(`
High
78`).map(SU).join(" + [Environment]::NewLine + "),xU=(e={})=>{let t={...IU,...e},n=()=>t.platform()==="win32",r=async()=>{let i=(await Jc(Nt(),vr))?.find(c=>c.startsWith("export COPI...
L79: `)):x&&Y&&await kl(S,{force:!0}),await Yu(c,M,vr)}catch(pe){try{W!==void 0&&Y?await Ee(S,W):Y&&await kl(S,{force:!0})}catch{throw new Error("Copilot CLI environment update failed a...
L80: import { spawn } from "node:child_process"
High
36`:o?`${o}
L37: `:"";return{text:a,outcome:a===e?"unchanged":"changed"}}});var ae,ge,Mo,De=F(()=>{"use strict";ae=(e,t)=>e.authMode==="subscription"?!0:e.authMode==="placeholder"?!1:e.seat?.[t]??!...
L38: `;)c-=1;if(s===-1){let d=new Set(n.map(m=>m.trim())),u=e.slice(c).split(`
...
L49: `),!0):!1}});var Sn,Ju=F(()=>{"use strict";Sn=e=>{if(e.length<=4)return"\u2026";let t=/^([a-z0-9]{2,6}_)/i.exec(e)?.[1]??"";return e.length>t.length+4?`${t}\u2026${e.slice(-4)}`:`\...
L50: `)):w&&b&&await Uy(d,{force:!0}),await Yu(n,p)}catch(g){try{y!==void 0&&b?await Ee(d,y):b&&await Uy(d,{force:!0})}catch{throw new Error("shell environment update failed and credent...
L51: `)?a.slice(0,-2):a.endsWith(`
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L36•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
var dM=Object.defineProperty;var F=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var cy=(e,t)=>{for(var n in t)dM(e,n,{get:t[n],enumerable:!0})}...
`,{mode:384}),await my(r,384);try{await Se(r,n)}catch(o){throw await Us(r,{force:!0}).catch(()=>{}),o}},ke=async e=>{if(vu.getStore()===!0){await py(e);return}let t=await gy();try{...
`:""},wI=e=>{if(e.trim().length===0)return!0;try{return HM(e),!0}catch{return!1}}});import{randomUUID as JM}from"node:crypto";import{chmod as zM,mkdir as qM,rm as QM,writeFile as e...
`:"";return{text:a,outcome:a===e?"unchanged":"changed"}}});var ae,ge,Mo,De=F
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg61`;)r+=1;r-=1;continue}if(o==="/"&&e[r+1]==="*"){let a=e.indexOf("*/",r+2);r=a===-1?e.length:a+1,t+=" ";continue}t+=o}return t},lW=e=>{let t="",n=!1;for(let r=0;r<e.length;r+=1){let...
L62: `,r=n.trim()?an(n):{};if(!fp(r))throw new Error(`${e} is not a JSON object`);return{data:r,raw:n,existed:t}},GS=(e,t,n=[])=>{if(fp(e)&&fp(t)){let r=[];for(let o of new Set([...Obje...
L63: `);let a={insertSpaces:!0,tabSize:2,eol:t.raw.includes(`\r
...
L71: `:`
L72: ${a}${s},`,d=`${i}${l}${c}`;try{let u=an(d);if(!FS(u))return{ok:!1,reason:"unsupported"};for(let[p,f]of Object.entries(r))if(JSON.stringify(u[p])!==JSON.stringify(f))return{ok:!1,r...
L73: `,{mode:384}),await Se(a,o)}catch{}finally{await sE(a,{force:!0})}},zW=async(e,t)=>{await gp(Ig(e,t)).catch(()=>{})},mE=async(e,t,n,r={},o={mode:"copil
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L6161Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js
L61: `;)r+=1;r-=1;continue}if(o==="/"&&e[r+1]==="*"){let a=e.indexOf("*/",r+2);r=a===-1?e.length:a+1,t+=" ";continue}t+=o}return t},lW=e=>{let t="",n=!1;for(let r=0;r<e.length;r+=1){let...
L62: `,r=n.trim()?an(n):{};if(!fp(r))throw new Error(`${e} is not a JSON object`);return{data:r,raw:n,existed:t}},GS=(e,t,n=[])=>{if(fp(e)&&fp(t)){let r=[];for(let o of new Set([...Obje...
L63: `);let a={insertSpaces:!0,tabSize:2,eol:t.raw.includes(`\r
...
L71: `:`
L72: ${a}${s},`,d=`${i}${l}${c}`;try{let u=an(d);if(!FS(u))return{ok:!1,reason:"unsupported"};for(let[p,f]of Object.entries(r))if(JSON.stringify(u[p])!==JSON.stringify(f))return{ok:!1,r...
L73: `,{mode:384}),await Se(a,o)}catch{}finally{await sE(a,{force:!0})}}
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.jsView on unpkg · L61Findings
1 Critical6 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to anyray-connect@0.11.216.
See all versions of anyray-connect for other recorded verdicts.
- Review the evidence and your use of anyray-connect@0.11.216 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.