anyray-connect@0.11.260
Anyray connect — points local coding tools (Claude Code, Cursor, Windsurf, SDKs) at the Anyray gateway through supported configuration and enrolled personal authentication.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe CLI is user-invoked and has no npm install hook, but it copies an existing Claude keychain session token into a helper aimed at a gateway whose host is not allowlisted. That is conditional credential exposure to an operator-configured endpoint, so the package should be warned rather than blocked.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the anyray-connect binary, or loads dist/index.js, which starts the CLI from process.argv.
Impact
A gateway the operator sets outside Anthropic can receive the user's Claude subscription token when the desktop client uses the helper. No install-time mutation was found.
Mechanism
The gateway origin is not limited to a vendor host. The Claude Desktop helper shells out to security find-generic-password and prints the oat token with gateway headers, while tool config such as Codex is rewritten toward that origin.
AI rationale
The CLI is user-invoked and has no npm install hook, but it copies an existing Claude keychain session token into a helper aimed at a gateway whose host is not allowlisted. That is conditional credential exposure to an operator-configured endpoint, so the package should be warned rather than blocked.
Evidence
dist/index.js.codex/config.toml.codex/hooks.jsonClaude Code-credentials
Network endpoints1
localhost:8787
Decision evidence
public snapshotAI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Gateway origin is any http or https URL from ANYRAY_GATEWAY_URL, a saved profile, or CLI flags, defaulting to http://localhost:8787, with no host allowlist.
- A Claude Desktop helper script reads the macOS keychain item Claude Code-credentials and extracts an sk-ant-oat token to print with gateway headers.
- The same user-run CLI targets local agent files such as Codex config.toml and hooks.json under the user .codex directory.
Evidence against
- package.json exposes a bin and build scripts only; there is no preinstall, install, or postinstall hook.
- The helper is written for an explicit subscription pass-through flow and states that connect does not store the token.
- Enrollment control-plane origin checks require https except loopback, separate from the gateway URL.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flagged · loading sourcedist/index.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: var P2=Object.defineProperty;var F=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var hb=(e,t)=>{for(var n in t)P2(e,n,{get:t[n],enumerable:!0})}...
L3: `,{flag:"wx",mode:384}),await Oe(l,a)}catch(d){throw await $s(l,{force:!0}).catch(()=>{}),await $s(e,{recursive:!0,force:!0}).catch(()=>{}),d}return async()=>{try{JSON.parse(await ...
L4: `,{mode:384}),await Cb(r,384);try{await Oe(r,n)}catch(o){throw await $s(r,{force:!0}).catch(()=>{}),o}},Me=async e=>{if(Xf.getStore()===!0){await bb(e);return}let t=await Sb();try{...
L5: `;if(a||n.tombstoneAbsent!==!1)try{await cx(r,s)}catch(i){if(i.code!=="EEXIST")throw i}}let o=`${e}.anyray-tmp-${process.pid}-${mx
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L155`),!0)}});var zn,Cm=F(()=>{"use strict";zn=e=>{if(e.length<=4)return"\u2026";let t=/^([a-z0-9]{2,6}_)/i.exec(e)?.[1]??"";return e.length>t.length+4?`${t}\u2026${e.slice(-4)}`:`\u20...
L56: `)):w&&y&&await rk(d,{force:!0}),await bm(n,p)}catch(b){try{g!==void 0&&y?await ke(d,g):y&&await rk(d,{force:!0})}catch{throw new Error("shell environment update failed and credent...
L57: `)?a.slice(0,-2):a.endsWith(`
High
118}
L119: `,EO=e=>new Promise((t,n)=>{let r=sX("powershell.exe",["-NoLogo","-NoProfile","-NonInteractive","-Command",pX],{encoding:"utf8",env:Ct(),windowsHide:!0,timeout:6e4,maxBuffer:131072...
L120: `))}`]:[],`export ${rC}=${ze(n)}`]},HO=(e,t,n)=>{let r=we({...e.metadata,tool:ci});return["export COPILOT_PROVIDER_TYPE='openai'",`export COPILOT_PROVIDER_BASE_URL=${ze(e.openaiBas...
High
41`);return o.length>0?o+`
L42: `:""},Kd=e=>{if(e.trim().length===0)return!0;try{return CV(e),!0}catch{return!1}}});import{randomUUID as TV}from"node:crypto";import{chmod as PV,mkdir as NV,rm as LV,writeFile as D...
L43: `;)c-=1;if(s===-1){let u=new Set(n.map(w=>w.trim())),p=e.slice(c).split(`
...
L55: `),!0)}});var zn,Cm=F(()=>{"use strict";zn=e=>{if(e.length<=4)return"\u2026";let t=/^([a-z0-9]{2,6}_)/i.exec(e)?.[1]??"";return e.length>t.length+4?`${t}\u2026${e.slice(-4)}`:`\u20...
L56: `)):w&&y&&await rk(d,{force:!0}),await bm(n,p)}catch(b){try{g!==void 0&&y?await ke(d,g):y&&await rk(d,{force:!0})}catch{throw new Error("shell environment update failed and credent...
L57: `)?a.slice(0,-2):a.endsWith(`
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L41•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
var P2=Object.defineProperty;var F=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var hb=(e,t)=>{for(var n in t)P2(e,n,{get:t[n],enumerable:!0})}...
`,{mode:384}),await Cb(r,384);try{await Oe(r,n)}catch(o){throw await $s(r,{force:!0}).catch(()=>{}),o}},Me=async e=>{if(Xf.getStore()===!0){await bb(e);return}let t=await Sb();try{...
`:""},Kd=e=>{if(e.trim().length===0)return!0;try{return CV(e),!0}catch{return!1}}});import{randomUUID as TV}from"node:crypto";import{chmod as PV,mkdir as NV,rm as LV,writeFile as D...
`),!0)}});var zn,Cm=F(()=>{"use strict";zn=e=>{if(e.length<=4)return"\u2026"
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg67`;)r+=1;r-=1;continue}if(o==="/"&&e[r+1]==="*"){let a=e.indexOf("*/",r+2);r=a===-1?e.length:a+1,t+=" ";continue}t+=o}return t},qZ=e=>{let t="",n=!1;for(let r=0;r<e.length;r+=1){let...
L68: `,r=n.trim()?_n(n):{};if(!Fm(r))throw new Error(`${e} is not a JSON object`);return{data:r,raw:n,existed:t}},u_=(e,t,n=[])=>{if(Fm(e)&&Fm(t)){let r=[];for(let o of new Set([...Obje...
L69: `);let a={insertSpaces:!0,tabSize:2,eol:t.raw.includes(`\r
...
L77: `:`
L78: ${a}${s},`,d=`${i}${l}${c}`;try{let u=_n(d);if(!p_(u))return{ok:!1,reason:"unsupported"};for(let[p,f]of Object.entries(r))if(JSON.stringify(u[p])!==JSON.stringify(f))return{ok:!1,r...
L79: `,{mode:384}),await Oe(a,o)}catch{}finally{await L_(a,{force:!0})}},nY=async(e,t)=>{await Dk($k(e,t)).catch(()=>{})},V_=async(e,t,n,r={},o={mode:"copil
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L6767Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js
L67: `;)r+=1;r-=1;continue}if(o==="/"&&e[r+1]==="*"){let a=e.indexOf("*/",r+2);r=a===-1?e.length:a+1,t+=" ";continue}t+=o}return t},qZ=e=>{let t="",n=!1;for(let r=0;r<e.length;r+=1){let...
L68: `,r=n.trim()?_n(n):{};if(!Fm(r))throw new Error(`${e} is not a JSON object`);return{data:r,raw:n,existed:t}},u_=(e,t,n=[])=>{if(Fm(e)&&Fm(t)){let r=[];for(let o of new Set([...Obje...
L69: `);let a={insertSpaces:!0,tabSize:2,eol:t.raw.includes(`\r
...
L77: `:`
L78: ${a}${s},`,d=`${i}${l}${c}`;try{let u=_n(d);if(!p_(u))return{ok:!1,reason:"unsupported"};for(let[p,f]of Object.entries(r))if(JSON.stringify(u[p])!==JSON.stringify(f))return{ok:!1,r...
L79: `,{mode:384}),await Oe(a,o)}catch{}finally{await L_(a,{force:!0})}}
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.jsView on unpkg · L67Findings
1 Critical6 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to anyray-connect@0.11.260.
See all versions of anyray-connect for other recorded verdicts.
- Review the evidence and your use of anyray-connect@0.11.260 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.