anyray-connect@0.11.243
Anyray connect — points local coding tools (Claude Code, Cursor, Windsurf, SDKs) at the Anyray gateway through supported configuration and enrolled personal authentication.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is an explicit user-run connector that rewrites coding-tool and remote-workspace configuration and can later follow gateway directives, which is a broad agent control capability. It does not install itself through npm lifecycle hooks, and the interactive path stops unless the user confirms or passes --yes.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A person runs the anyray-connect command, or an already enrolled refresh or directive job runs later.
Impact
Coding-tool configs on the machine and on discovered remote workspaces are pointed at the configured Anyray gateway, and those tools send the enrolled client credential with requests. Orbit service paths are part of the fleet-managed install surface.
Mechanism
The CLI edits tool configuration and can spawn ssh, docker, wsl, or gh to pipe https://app.anyray.ai/connect.sh into a shell, then reapply with the client key. Enrolled clients GET /connect/directive and execute a fixed set of config actions.
AI rationale
This is an explicit user-run connector that rewrites coding-tool and remote-workspace configuration and can later follow gateway directives, which is a broad agent control capability. It does not install itself through npm lifecycle hooks, and the interactive path stops unless the user confirms or passes --yes.
Evidence
package.jsondist/index.js/Library/LaunchDaemons/com.fleetdm.orbit.plist/opt/orbit/bin/orbit/etc/systemd/system/orbit.service/usr/lib/systemd/system/orbit.serviceC:\Program Files\Orbit\bin\orbit\orbit.exe.anyray/bin/anyray-connect
Network endpoints2
app.anyray.ai/connect.shgithub.com/anyrayHQ/install/releases/download/
Decision evidence
public snapshotAI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The published bin is dist/index.js and it starts by calling g1 on process.argv. package.json has no preinstall, install, or postinstall script.
- Apply writes a Claude HTTP hook for matcher * to the configured gateway path /connect/optimize-output and places the client key and Anthropic auth token in that hook.
- Interactive apply writes nothing if the user declines. A non-interactive session requires --yes before it proceeds.
- A workspace helper downloads https://app.anyray.ai/connect.sh and pipes it to sh over ssh, docker, wsl, or gh codespace sessions taken from editor state, then reapplies with --yes and the client key on stdin.
- After enrollment, refresh pulls /connect/directive and can run reapply_config, remint, revert, revert_tool, or update.
- Fleet code names Orbit LaunchDaemon, systemd, and Windows paths and a GitHub fleetd installer release under anyrayHQ/install.
Evidence against
- Lifecycle scripts are limited to dev, build, test, start, prepack, and prepublishOnly.
- The default interactive path asks before writing and stops on decline.
- Control-plane origin checks require https, or http only for loopback, and the gateway URL is caller-supplied.
- Hook and remote-install behavior matches the package description of pointing local coding tools at an Anyray gateway.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flagged · loading sourcedist/index.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: var v1=Object.defineProperty;var G=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var yw=(e,t)=>{for(var n in t)v1(e,n,{get:t[n],enumerable:!0})}...
L3: `,{flag:"wx",mode:384}),await Oe(l,a)}catch(d){throw await ps(l,{force:!0}).catch(()=>{}),await ps(e,{recursive:!0,force:!0}).catch(()=>{}),d}return async()=>{try{JSON.parse(await ...
L4: `,{mode:384}),await Aw(r,384);try{await Oe(r,n)}catch(o){throw await ps(r,{force:!0}).catch(()=>{}),o}},xe=async e=>{if(nf.getStore()===!0){await kw(e);return}let t=await Iw();try{...
L5: `;if(a||n.tombstoneAbsent!==!1)try{await YE(r,s)}catch(i){if(i.code!=="EEXIST")throw i}}let o=`${e}.anyray-tmp-${process.pid}-${e0
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L152`),!0)}});var Zn,xf=G(()=>{"use strict";Zn=e=>{if(e.length<=4)return"\u2026";let t=/^([a-z0-9]{2,6}_)/i.exec(e)?.[1]??"";return e.length>t.length+4?`${t}\u2026${e.slice(-4)}`:`\u20...
L53: `)):g&&w&&await zw(d,{force:!0}),await If(n,p)}catch(b){try{y!==void 0&&w?await Se(d,y):w&&await zw(d,{force:!0})}catch{throw new Error("shell environment update failed and credent...
L54: `)?a.slice(0,-2):a.endsWith(`
High
115}
L116: `,rO=e=>new Promise((t,n)=>{let r=NZ("powershell.exe",["-NoLogo","-NoProfile","-NonInteractive","-Command",GZ],{encoding:"utf8",windowsHide:!0,timeout:6e4,maxBuffer:131072},(o,a)=>...
L117: `))}`]:[],`export ${Jb}=${Je(n)}`]},wO=(e,t,n)=>{let r=ge({...e.metadata,tool:Ls});return["export COPILOT_PROVIDER_TYPE='openai'",`export COPILOT_PROVIDER_BASE_URL=${Je(e.openaiBas...
High
38`);return o.length>0?o+`
L39: `:""},rd=e=>{if(e.trim().length===0)return!0;try{return dU(e),!0}catch{return!1}}});import{randomUUID as kU}from"node:crypto";import{chmod as CU,mkdir as AU,rm as vU,writeFile as S...
L40: `;)c-=1;if(s===-1){let u=new Set(n.map(g=>g.trim())),p=e.slice(c).split(`
...
L52: `),!0)}});var Zn,xf=G(()=>{"use strict";Zn=e=>{if(e.length<=4)return"\u2026";let t=/^([a-z0-9]{2,6}_)/i.exec(e)?.[1]??"";return e.length>t.length+4?`${t}\u2026${e.slice(-4)}`:`\u20...
L53: `)):g&&w&&await zw(d,{force:!0}),await If(n,p)}catch(b){try{y!==void 0&&w?await Se(d,y):w&&await zw(d,{force:!0})}catch{throw new Error("shell environment update failed and credent...
L54: `)?a.slice(0,-2):a.endsWith(`
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L38•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
var v1=Object.defineProperty;var G=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var yw=(e,t)=>{for(var n in t)v1(e,n,{get:t[n],enumerable:!0})}...
`,{mode:384}),await Aw(r,384);try{await Oe(r,n)}catch(o){throw await ps(r,{force:!0}).catch(()=>{}),o}},xe=async e=>{if(nf.getStore()===!0){await kw(e);return}let t=await Iw();try{...
`:""},rd=e=>{if(e.trim().length===0)return!0;try{return dU(e),!0}catch{return!1}}});import{randomUUID as kU}from"node:crypto";import{chmod as CU,mkdir as AU,rm as vU,writeFile as S...
`),!0)}});var Zn,xf=G(()=>{"use strict";Zn=e=>{if(e.length<=4)return"\u2026"
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg64`;)r+=1;r-=1;continue}if(o==="/"&&e[r+1]==="*"){let a=e.indexOf("*/",r+2);r=a===-1?e.length:a+1,t+=" ";continue}t+=o}return t},DV=e=>{let t="",n=!1;for(let r=0;r<e.length;r+=1){let...
L65: `,r=n.trim()?vn(n):{};if(!Uf(r))throw new Error(`${e} is not a JSON object`);return{data:r,raw:n,existed:t}},Vx=(e,t,n=[])=>{if(Uf(e)&&Uf(t)){let r=[];for(let o of new Set([...Obje...
L66: `);let a={insertSpaces:!0,tabSize:2,eol:t.raw.includes(`\r
...
L74: `:`
L75: ${a}${s},`,d=`${i}${l}${c}`;try{let u=vn(d);if(!Kx(u))return{ok:!1,reason:"unsupported"};for(let[p,f]of Object.entries(r))if(JSON.stringify(u[p])!==JSON.stringify(f))return{ok:!1,r...
L76: `,{mode:384}),await Oe(a,o)}catch{}finally{await uR(a,{force:!0})}},vK=async(e,t)=>{await jf(Pb(e,t)).catch(()=>{})},bR=async(e,t,n,r={},o={mode:"copil
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L6464Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js
L64: `;)r+=1;r-=1;continue}if(o==="/"&&e[r+1]==="*"){let a=e.indexOf("*/",r+2);r=a===-1?e.length:a+1,t+=" ";continue}t+=o}return t},DV=e=>{let t="",n=!1;for(let r=0;r<e.length;r+=1){let...
L65: `,r=n.trim()?vn(n):{};if(!Uf(r))throw new Error(`${e} is not a JSON object`);return{data:r,raw:n,existed:t}},Vx=(e,t,n=[])=>{if(Uf(e)&&Uf(t)){let r=[];for(let o of new Set([...Obje...
L66: `);let a={insertSpaces:!0,tabSize:2,eol:t.raw.includes(`\r
...
L74: `:`
L75: ${a}${s},`,d=`${i}${l}${c}`;try{let u=vn(d);if(!Kx(u))return{ok:!1,reason:"unsupported"};for(let[p,f]of Object.entries(r))if(JSON.stringify(u[p])!==JSON.stringify(f))return{ok:!1,r...
L76: `,{mode:384}),await Oe(a,o)}catch{}finally{await uR(a,{force:!0})}}
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.jsView on unpkg · L64Findings
1 Critical6 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to anyray-connect@0.11.243.
See all versions of anyray-connect for other recorded verdicts.
- Review the evidence and your use of anyray-connect@0.11.243 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.