registry / AI-agent capability abuse / anyray-connect / 0.11.272

anyray-connect@0.11.272

Anyray connect — points local coding tools (Claude Code, Cursor, Windsurf, SDKs) at the Anyray gateway through supported configuration and enrolled personal authentication.

AI Security Review

scanned 19d ago · by lpm-firewall-ai

Source inspection supports a guarded, user-command agent configuration capability rather than the scanner's malicious classification. MCP preapproval and hook installation warrant a behavior-specific warning, while confirmation and the absence of registry install hooks prevent an install-time hijack finding.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Running the configuration CLI and confirming setup or supplying --yes.

Impact

Changes agent capabilities and exposes selected context to the chosen gateway; saved setup can enable subsequent credential refresh.

Mechanism

Writes agent configuration and hooks, registers preapproved MCP tools, and sends tool output to the configured gateway.

AI rationale

Evidence

dist/index.js.codexconfig.tomlhooks.json

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest has no preinstall, install, or postinstall hook; configuration changes occur through the CLI.
The CLI writes Codex configuration and hooks under CODEX_HOME or .codex.
Generated MCP configuration preapproves Anyray tools, creating a concrete agent capability that warrants a warning.
Applying configuration requires confirmation or --yes; noninteractive execution otherwise stops.
The configured gateway receives tool output and retrieval context through an optimization request.
The saved runtime profile can enable automatic credential refresh after setup.

Evidence against

No inspected source establishes covert theft or malicious install behavior.
Configuration includes backups, refusal to overwrite foreign entries, dry-run support, and revert handling.
Gateway requests are consistent with the implemented routing and context optimization functionality.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Source & flagged code

7 flagged

dist/index.jsView file

1Source sends the broad process environment to a literal external destination. L1: #!/usr/bin/env node L2: var RX=Object.defineProperty;var M=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var bA=(e,t)=>{for(var n in t)RX(e,n,{get:t[n],enumerable:!0})}... L3: `,{flag:"wx",mode:384}),await Te(l,a)}catch(d){throw await mi(l,{force:!0}).catch(()=>{}),await mi(e,{recursive:!0,force:!0}).catch(()=>{}),d}return async()=>{try{JSON.parse(await ... L4: `,{mode:384}),await EA(a,384);try{await Te(a,n)}catch(s){throw await mi(a,{force:!0}).catch(()=>{}),s}},We=async e=>{if(kh.getStore()===!0){await vA(e);return}let t=await _A();try{... L5: `;if(a||n.tombstoneAbsent!==!1)try{await EO(r,s)}catch(i){if(i.code!=="EEXIST")throw i}}let o=`${e}.anyray-tmp-${process.pid}-${TO

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L1

56`)},Xh=e=>!e.byoUpstream&&!pe(e,"anthropic"),Jh="",vo=(e,t={})=>{let n=e.byoUpstream,r=!n&&pe(e,"anthropic"),o=Se({...e.metadata,tool:e.metadata.tool??"claude-code"}),a=t.includeCl... L57: `)):y&&k&&await zh(u,{force:!0}),await Rh(n,h)}catch(A){try{b!==void 0&&k?await Ie(u,b):k&&await zh(u,{force:!0})}catch{throw new Error("shell environment update failed and credent... L58: `)?a.slice(0,-2):a.endsWith(`

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L56

126} L127: `,uN=e=>new Promise((t,n)=>{let r=W4("powershell.exe",["-NoLogo","-NoProfile","-NonInteractive","-Command",X4],{encoding:"utf8",env:Nt(),windowsHide:!0,timeout:6e4,maxBuffer:131072... L128: `))}`]:[],`export ${Ev}=${He(n)}`]},IN=(e,t,n)=>{let r=Se({...e.metadata,tool:$i});return["export COPILOT_PROVIDER_TYPE='openai'",`export COPILOT_PROVIDER_BASE_URL=${He(e.openaiBas...

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L126

54`);return o.length>0?o+` L55: `:""},np=e=>{if(e.trim().length===0)return!0;try{return BJ(e),!0}catch{return!1}}});import{randomUUID as ZJ}from"node:crypto";import{chmod as YJ,mkdir as XJ,rm as JJ,writeFile as z... L56: `)},Xh=e=>!e.byoUpstream&&!pe(e,"anthropic"),Jh="",vo=(e,t={})=>{let n=e.byoUpstream,r=!n&&pe(e,"anthropic"),o=Se({...e.metadata,tool:e.metadata.tool??"claude-code"}),a=t.includeCl... L57: `)):y&&k&&await zh(u,{force:!0}),await Rh(n,h)}catch(A){try{b!==void 0&&k?await Ie(u,b):k&&await zh(u,{force:!0})}catch{throw new Error("shell environment update failed and credent... L58: `)?a.slice(0,-2):a.endsWith(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L54

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: var RX=Object.defineProperty;var M=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var bA=(e,t)=>{for(var n in t)RX(e,n,{get:t[n],enumerable:!0})}... `,{mode:384}),await EA(a,384);try{await Te(a,n)}catch(s){throw await mi(a,{force:!0}).catch(()=>{}),s}},We=async e=>{if(kh.getStore()===!0){await vA(e);return}let t=await _A();try{... `,r),s=a<0?e.length:a;if(e.slice(o,s).trim()===t)return o;r=e.indexOf(t,r+t.length)}return-1}});import{readFile as oJ,writeFile as HO,access as aJ}from"node:fs/promises";import{rea... `:""},np=e=>{if(e.trim().length===0)return!0;try{return BJ(e),!0}catch{retur

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L54

54Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js L54: `);return o.length>0?o+` L55: `:""},np=e=>{if(e.trim().length===0)return!0;try{return BJ(e),!0}catch{return!1}}});import{randomUUID as ZJ}from"node:crypto";import{chmod as YJ,mkdir as XJ,rm as JJ,writeFile as z... L56: `)},Xh=e=>!e.byoUpstream&&!pe(e,"anthropic"),Jh="",vo=(e,t={})=>{let n=e.byoUpstream,r=!n&&pe(e,"anthropic"),o=Se({...e.metadata,tool:e.metadata.tool??"claude-code"}),a=t.includeCl... L57: `)):y&&k&&await zh(u,{force:!0}),await Rh(n,h)}catch(A){try{b!==void 0&&k?await Ie(u,b):k&&await zh(u,{force:!0})}catch{throw new Error("shell environment update failed and credent... L58: `)?a.slice(0,-2):a.endsWith(` ... L63: `);ry("sqlite3",[e],{input:o,encoding:"utf-8",maxBuffer:hC,stdio:["pipe","i

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L54

Source & flagged code

7 flagged · loading source

dist/index.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L1

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L56

Findings

1 Critical6 High3 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/index.js

HighChild Processdist/index.js

HighShelldist/index.js

HighSame File Env Network Executiondist/index.js

HighCredential Redirect Persistencedist/index.js

HighCommand Output Exfiltrationdist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to anyray-connect@0.11.272.

See all versions of anyray-connect for other recorded verdicts.

Review the evidence and your use of anyray-connect@0.11.272 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-03 22:07:11.008Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code