anyray-connect@0.11.261
Anyray connect — points local coding tools (Claude Code, Cursor, Windsurf, SDKs) at the Anyray gateway through supported configuration and enrolled personal authentication.
AI Security Review
scanned 25d ago · by lpm-firewall-aiConnect does not mutate agent config at npm install, but an explicit Copilot setup path forwards a harvested GitHub Copilot token to whatever https gateway the operator configured. That is conditional credential exposure to an unbound destination, not a hidden install-time hijack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs the anyray-connect CLI so that Copilot seat discovery or model catalog fetch executes.
Impact
A gateway operator, or anyone who can set ANYRAY_GATEWAY_URL or the saved gateway, can receive the user's Copilot session token during an otherwise intentional connect.
Mechanism
Local Copilot OAuth material is loaded and sent with Authorization Bearer to laneOrigin, set from the configured gateway origin, plus the Anyray client key.
AI rationale
Connect does not mutate agent config at npm install, but an explicit Copilot setup path forwards a harvested GitHub Copilot token to whatever https gateway the operator configured. That is conditional credential exposure to an unbound destination, not a hidden install-time hijack.
Evidence
dist/index.js~/.copilot/config.json~/.config/github-copilot/apps.json~/.config/github-copilot/hosts.json~/.codex/config.toml~/.codex/hooks.json
Network endpoints2
api.github.com/copilot_internal/userapi.githubcopilot.com
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The published package is a CLI (bin dist/index.js) with no preinstall, install, or postinstall hook; configuration runs only when the user executes the command.
- Copilot setup reads an existing GitHub Copilot token from local Copilot CLI config, shared GitHub Copilot config, OpenCode auth, or the macOS keychain.
- That token is sent as Authorization Bearer to a caller-supplied laneOrigin equal to the configured Anyray gateway, which accepts any https host, before falling back to api.githubcopilot.com.
- The same CLI writes Codex routing under the user Codex home (config.toml and hooks.json) only as part of an explicit connect apply.
Evidence against
- Keychain lookup is gated by allowKeychainPrompt, and the token is first checked against https://api.github.com/copilot_internal/user.
- Apply refuses a non-interactive run unless --yes is passed, and the default gateway constant is http://localhost:8787.
- No install-time or import-time mutation of agent config was found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flagged · loading sourcedist/index.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: var P2=Object.defineProperty;var F=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var hb=(e,t)=>{for(var n in t)P2(e,n,{get:t[n],enumerable:!0})}...
L3: `,{flag:"wx",mode:384}),await Oe(l,a)}catch(d){throw await $s(l,{force:!0}).catch(()=>{}),await $s(e,{recursive:!0,force:!0}).catch(()=>{}),d}return async()=>{try{JSON.parse(await ...
L4: `,{mode:384}),await Cb(r,384);try{await Oe(r,n)}catch(o){throw await $s(r,{force:!0}).catch(()=>{}),o}},Me=async e=>{if(Xf.getStore()===!0){await bb(e);return}let t=await Sb();try{...
L5: `;if(a||n.tombstoneAbsent!==!1)try{await cx(r,s)}catch(i){if(i.code!=="EEXIST")throw i}}let o=`${e}.anyray-tmp-${process.pid}-${mx
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L155`),!0)}});var zn,Cm=F(()=>{"use strict";zn=e=>{if(e.length<=4)return"\u2026";let t=/^([a-z0-9]{2,6}_)/i.exec(e)?.[1]??"";return e.length>t.length+4?`${t}\u2026${e.slice(-4)}`:`\u20...
L56: `)):w&&y&&await rk(d,{force:!0}),await bm(n,p)}catch(b){try{g!==void 0&&y?await ke(d,g):y&&await rk(d,{force:!0})}catch{throw new Error("shell environment update failed and credent...
L57: `)?a.slice(0,-2):a.endsWith(`
High
118}
L119: `,EO=e=>new Promise((t,n)=>{let r=sX("powershell.exe",["-NoLogo","-NoProfile","-NonInteractive","-Command",pX],{encoding:"utf8",env:Ct(),windowsHide:!0,timeout:6e4,maxBuffer:131072...
L120: `))}`]:[],`export ${rC}=${ze(n)}`]},HO=(e,t,n)=>{let r=we({...e.metadata,tool:ci});return["export COPILOT_PROVIDER_TYPE='openai'",`export COPILOT_PROVIDER_BASE_URL=${ze(e.openaiBas...
High
41`);return o.length>0?o+`
L42: `:""},Kd=e=>{if(e.trim().length===0)return!0;try{return CV(e),!0}catch{return!1}}});import{randomUUID as TV}from"node:crypto";import{chmod as PV,mkdir as NV,rm as LV,writeFile as D...
L43: `;)c-=1;if(s===-1){let u=new Set(n.map(w=>w.trim())),p=e.slice(c).split(`
...
L55: `),!0)}});var zn,Cm=F(()=>{"use strict";zn=e=>{if(e.length<=4)return"\u2026";let t=/^([a-z0-9]{2,6}_)/i.exec(e)?.[1]??"";return e.length>t.length+4?`${t}\u2026${e.slice(-4)}`:`\u20...
L56: `)):w&&y&&await rk(d,{force:!0}),await bm(n,p)}catch(b){try{g!==void 0&&y?await ke(d,g):y&&await rk(d,{force:!0})}catch{throw new Error("shell environment update failed and credent...
L57: `)?a.slice(0,-2):a.endsWith(`
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L41•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
var P2=Object.defineProperty;var F=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var hb=(e,t)=>{for(var n in t)P2(e,n,{get:t[n],enumerable:!0})}...
`,{mode:384}),await Cb(r,384);try{await Oe(r,n)}catch(o){throw await $s(r,{force:!0}).catch(()=>{}),o}},Me=async e=>{if(Xf.getStore()===!0){await bb(e);return}let t=await Sb();try{...
`:""},Kd=e=>{if(e.trim().length===0)return!0;try{return CV(e),!0}catch{return!1}}});import{randomUUID as TV}from"node:crypto";import{chmod as PV,mkdir as NV,rm as LV,writeFile as D...
`),!0)}});var zn,Cm=F(()=>{"use strict";zn=e=>{if(e.length<=4)return"\u2026"
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg67`;)r+=1;r-=1;continue}if(o==="/"&&e[r+1]==="*"){let a=e.indexOf("*/",r+2);r=a===-1?e.length:a+1,t+=" ";continue}t+=o}return t},qZ=e=>{let t="",n=!1;for(let r=0;r<e.length;r+=1){let...
L68: `,r=n.trim()?_n(n):{};if(!Fm(r))throw new Error(`${e} is not a JSON object`);return{data:r,raw:n,existed:t}},u_=(e,t,n=[])=>{if(Fm(e)&&Fm(t)){let r=[];for(let o of new Set([...Obje...
L69: `);let a={insertSpaces:!0,tabSize:2,eol:t.raw.includes(`\r
...
L77: `:`
L78: ${a}${s},`,d=`${i}${l}${c}`;try{let u=_n(d);if(!p_(u))return{ok:!1,reason:"unsupported"};for(let[p,f]of Object.entries(r))if(JSON.stringify(u[p])!==JSON.stringify(f))return{ok:!1,r...
L79: `,{mode:384}),await Oe(a,o)}catch{}finally{await L_(a,{force:!0})}},nY=async(e,t)=>{await Dk($k(e,t)).catch(()=>{})},V_=async(e,t,n,r={},o={mode:"copil
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L6767Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js
L67: `;)r+=1;r-=1;continue}if(o==="/"&&e[r+1]==="*"){let a=e.indexOf("*/",r+2);r=a===-1?e.length:a+1,t+=" ";continue}t+=o}return t},qZ=e=>{let t="",n=!1;for(let r=0;r<e.length;r+=1){let...
L68: `,r=n.trim()?_n(n):{};if(!Fm(r))throw new Error(`${e} is not a JSON object`);return{data:r,raw:n,existed:t}},u_=(e,t,n=[])=>{if(Fm(e)&&Fm(t)){let r=[];for(let o of new Set([...Obje...
L69: `);let a={insertSpaces:!0,tabSize:2,eol:t.raw.includes(`\r
...
L77: `:`
L78: ${a}${s},`,d=`${i}${l}${c}`;try{let u=_n(d);if(!p_(u))return{ok:!1,reason:"unsupported"};for(let[p,f]of Object.entries(r))if(JSON.stringify(u[p])!==JSON.stringify(f))return{ok:!1,r...
L79: `,{mode:384}),await Oe(a,o)}catch{}finally{await L_(a,{force:!0})}}
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.jsView on unpkg · L67Findings
1 Critical6 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to anyray-connect@0.11.261.
See all versions of anyray-connect for other recorded verdicts.
- Review the evidence and your use of anyray-connect@0.11.261 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.