anyray-connect@0.11.221: AI-agent capability abuse – flagged

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is an explicit-user AI-agent configuration tool with broad capability and remote policy synchronization, so it warrants a warning. The inspected source does not establish automatic installation, stealth persistence, or concrete credential exfiltration sufficient for a block.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The user runs anyray-connect and confirms the configuration, or explicitly passes --yes.

Impact

A configured gateway or its supplied policy can influence agent configuration and receive routed AI traffic; the installed hook can process agent tool output locally.

Mechanism

AI-tool configuration mutation, remote policy synchronization, and a post-tool child-process hook.

AI rationale

This is an explicit-user AI-agent configuration tool with broad capability and remote policy synchronization, so it warrants a warning. The inspected source does not establish automatic installation, stealth persistence, or concrete credential exfiltration sufficient for a block.

Evidence

dist/index.jspackage.json~/.anyray~/.config/opencode/plugins/anyrayTrim.js

Network endpoints1

app.anyray.ai

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The CLI creates an OpenCode post-tool hook that sends tool arguments and output to a spawned child process.
After enrollment, it fetches team policy and synchronizes remote skills and MCP entries into configured AI tools.
It stores a gateway credential and repoints supported coding tools through that gateway.

Evidence against

package.json has no preinstall, install, or postinstall hook.
Configuration changes require an explicit CLI run and refuse non-interactive application without --yes.
No concrete secret exfiltration or install-time execution was established from the inspected source.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 993 KB of source, external domains: api.github.com, api.githubcopilot.com, app.anyray.ai, chatgpt.com, github.com, gw.acme.com, opencode.ai, www.apple.com

Source & flagged code

5 flagged

dist/index.jsView file

1Source sends the broad process environment to a literal external destination. L1: #!/usr/bin/env node L2: var aG=Object.defineProperty;var F=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var xy=(e,t)=>{for(var n in t)aG(e,n,{get:t[n],enumerable:!0})}... L3: `,{mode:384})}catch(c){throw await qs(e,{recursive:!0,force:!0}).catch(()=>{}),c}return async()=>{try{JSON.parse(await ol(o,"utf-8")).nonce===s&&await qs(e,{recursive:!0,force:!0})... L4: `,{mode:384}),await Ny(r,384);try{await xe(r,n)}catch(o){throw await qs(r,{force:!0}).catch(()=>{}),o}},Ce=async e=>{if(Uu.getStore()===!0){await Py(e);return}let t=await By();try{... L5: `;if(a||n.tombstoneAbsent!==!1)try{await vI(r,s)}catch(i){if(i.code!=="EEXIST")throw i}}let o=`${e}.anyray-tmp-${process.pid}-${OI

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L1

34`);return o.length>0?o+` L35: `:""},ap=e=>{if(e.trim().length===0)return!0;try{return WG(e),!0}catch{return!1}}});import{randomUUID as zG}from"node:crypto";import{chmod as qG,mkdir as QG,rm as eF,writeFile as t... L36: `;)c-=1;if(s===-1){let d=new Set(n.map(m=>m.trim())),u=e.slice(c).split(` ... L47: `),!0):!1}});var In,pp=F(()=>{"use strict";In=e=>{if(e.length<=4)return"\u2026";let t=/^([a-z0-9]{2,6}_)/i.exec(e)?.[1]??"";return e.length>t.length+4?`${t}\u2026${e.slice(-4)}`:`\... L48: `)):g&&b&&await dg(d,{force:!0}),await dp(n,p)}catch(w){try{y!==void 0&&b?await Re(d,y):b&&await dg(d,{force:!0})}catch{throw new Error("shell environment update failed and credent... L49: `)?a.slice(0,-2):a.endsWith(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L34

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: var aG=Object.defineProperty;var F=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var xy=(e,t)=>{for(var n in t)aG(e,n,{get:t[n],enumerable:!0})}... `,{mode:384}),await Ny(r,384);try{await xe(r,n)}catch(o){throw await qs(r,{force:!0}).catch(()=>{}),o}},Ce=async e=>{if(Uu.getStore()===!0){await Py(e);return}let t=await By();try{... `:""},ap=e=>{if(e.trim().length===0)return!0;try{return WG(e),!0}catch{return!1}}});import{randomUUID as zG}from"node:crypto";import{chmod as qG,mkdir as QG,rm as eF,writeFile as t... `),!0):!1}});var In,pp=F(()=>{"use strict";In=e=>{if(e.length<=4)return"\u20

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

59`;)r+=1;r-=1;continue}if(o==="/"&&e[r+1]==="*"){let a=e.indexOf("*/",r+2);r=a===-1?e.length:a+1,t+=" ";continue}t+=o}return t},cH=e=>{let t="",n=!1;for(let r=0;r<e.length;r+=1){let... L60: `,r=n.trim()?on(n):{};if(!Rp(r))throw new Error(`${e} is not a JSON object`);return{data:r,raw:n,existed:t}},wE=(e,t,n=[])=>{if(Rp(e)&&Rp(t)){let r=[];for(let o of new Set([...Obje... L61: `);let a={insertSpaces:!0,tabSize:2,eol:t.raw.includes(`\r ... L69: `:` L70: ${a}${s},`,d=`${i}${l}${c}`;try{let u=on(d);if(!bE(u))return{ok:!1,reason:"unsupported"};for(let[p,f]of Object.entries(r))if(JSON.stringify(u[p])!==JSON.stringify(f))return{ok:!1,r... L71: `,{mode:384}),await xe(a,o)}catch{}finally{await GE(a,{force:!0})}},JH=async(e,t)=>{await Tp(Zg(e,t)).catch(()=>{})},jE=async(e,t,n,r={},o={mode:"copil

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L59

59Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js L59: `;)r+=1;r-=1;continue}if(o==="/"&&e[r+1]==="*"){let a=e.indexOf("*/",r+2);r=a===-1?e.length:a+1,t+=" ";continue}t+=o}return t},cH=e=>{let t="",n=!1;for(let r=0;r<e.length;r+=1){let... L60: `,r=n.trim()?on(n):{};if(!Rp(r))throw new Error(`${e} is not a JSON object`);return{data:r,raw:n,existed:t}},wE=(e,t,n=[])=>{if(Rp(e)&&Rp(t)){let r=[];for(let o of new Set([...Obje... L61: `);let a={insertSpaces:!0,tabSize:2,eol:t.raw.includes(`\r ... L69: `:` L70: ${a}${s},`,d=`${i}${l}${c}`;try{let u=on(d);if(!bE(u))return{ok:!1,reason:"unsupported"};for(let[p,f]of Object.entries(r))if(JSON.stringify(u[p])!==JSON.stringify(f))return{ok:!1,r... L71: `,{mode:384}),await xe(a,o)}catch{}finally{await GE(a,{force:!0})}}

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L59

Source & flagged code

5 flagged · loading source

dist/index.jsView file

1Source sends the broad process environment to a literal external destination. L1: #!/usr/bin/env node L2: var aG=Object.defineProperty;var F=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var xy=(e,t)=>{for(var n in t)aG(e,n,{get:t[n],enumerable:!0})}... L3: `,{mode:384})}catch(c){throw await qs(e,{recursive:!0,force:!0}).catch(()=>{}),c}return async()=>{try{JSON.parse(await ol(o,"utf-8")).nonce===s&&await qs(e,{recursive:!0,force:!0})... L4: `,{mode:384}),await Ny(r,384);try{await xe(r,n)}catch(o){throw await qs(r,{force:!0}).catch(()=>{}),o}},Ce=async e=>{if(Uu.getStore()===!0){await Py(e);return}let t=await By();try{... L5: `;if(a||n.tombstoneAbsent!==!1)try{await vI(r,s)}catch(i){if(i.code!=="EEXIST")throw i}}let o=`${e}.anyray-tmp-${process.pid}-${OI

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L1

34`);return o.length>0?o+` L35: `:""},ap=e=>{if(e.trim().length===0)return!0;try{return WG(e),!0}catch{return!1}}});import{randomUUID as zG}from"node:crypto";import{chmod as qG,mkdir as QG,rm as eF,writeFile as t... L36: `;)c-=1;if(s===-1){let d=new Set(n.map(m=>m.trim())),u=e.slice(c).split(` ... L47: `),!0):!1}});var In,pp=F(()=>{"use strict";In=e=>{if(e.length<=4)return"\u2026";let t=/^([a-z0-9]{2,6}_)/i.exec(e)?.[1]??"";return e.length>t.length+4?`${t}\u2026${e.slice(-4)}`:`\... L48: `)):g&&b&&await dg(d,{force:!0}),await dp(n,p)}catch(w){try{y!==void 0&&b?await Re(d,y):b&&await dg(d,{force:!0})}catch{throw new Error("shell environment update failed and credent... L49: `)?a.slice(0,-2):a.endsWith(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L34

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: var aG=Object.defineProperty;var F=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var xy=(e,t)=>{for(var n in t)aG(e,n,{get:t[n],enumerable:!0})}... `,{mode:384}),await Ny(r,384);try{await xe(r,n)}catch(o){throw await qs(r,{force:!0}).catch(()=>{}),o}},Ce=async e=>{if(Uu.getStore()===!0){await Py(e);return}let t=await By();try{... `:""},ap=e=>{if(e.trim().length===0)return!0;try{return WG(e),!0}catch{return!1}}});import{randomUUID as zG}from"node:crypto";import{chmod as qG,mkdir as QG,rm as eF,writeFile as t... `),!0):!1}});var In,pp=F(()=>{"use strict";In=e=>{if(e.length<=4)return"\u20

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

59`;)r+=1;r-=1;continue}if(o==="/"&&e[r+1]==="*"){let a=e.indexOf("*/",r+2);r=a===-1?e.length:a+1,t+=" ";continue}t+=o}return t},cH=e=>{let t="",n=!1;for(let r=0;r<e.length;r+=1){let... L60: `,r=n.trim()?on(n):{};if(!Rp(r))throw new Error(`${e} is not a JSON object`);return{data:r,raw:n,existed:t}},wE=(e,t,n=[])=>{if(Rp(e)&&Rp(t)){let r=[];for(let o of new Set([...Obje... L61: `);let a={insertSpaces:!0,tabSize:2,eol:t.raw.includes(`\r ... L69: `:` L70: ${a}${s},`,d=`${i}${l}${c}`;try{let u=on(d);if(!bE(u))return{ok:!1,reason:"unsupported"};for(let[p,f]of Object.entries(r))if(JSON.stringify(u[p])!==JSON.stringify(f))return{ok:!1,r... L71: `,{mode:384}),await xe(a,o)}catch{}finally{await GE(a,{force:!0})}},JH=async(e,t)=>{await Tp(Zg(e,t)).catch(()=>{})},jE=async(e,t,n,r={},o={mode:"copil

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L59

59Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js L59: `;)r+=1;r-=1;continue}if(o==="/"&&e[r+1]==="*"){let a=e.indexOf("*/",r+2);r=a===-1?e.length:a+1,t+=" ";continue}t+=o}return t},cH=e=>{let t="",n=!1;for(let r=0;r<e.length;r+=1){let... L60: `,r=n.trim()?on(n):{};if(!Rp(r))throw new Error(`${e} is not a JSON object`);return{data:r,raw:n,existed:t}},wE=(e,t,n=[])=>{if(Rp(e)&&Rp(t)){let r=[];for(let o of new Set([...Obje... L61: `);let a={insertSpaces:!0,tabSize:2,eol:t.raw.includes(`\r ... L69: `:` L70: ${a}${s},`,d=`${i}${l}${c}`;try{let u=on(d);if(!bE(u))return{ok:!1,reason:"unsupported"};for(let[p,f]of Object.entries(r))if(JSON.stringify(u[p])!==JSON.stringify(f))return{ok:!1,r... L71: `,{mode:384}),await xe(a,o)}catch{}finally{await GE(a,{force:!0})}}

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L59

Findings

1 Critical4 High3 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/index.js

HighSame File Env Network Executiondist/index.js

HighCredential Redirect Persistencedist/index.js

HighCommand Output Exfiltrationdist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code