anyray-connect@0.11.282
Anyray connect — points local coding tools (Claude Code, Cursor, Windsurf, SDKs) at the Anyray gateway through supported configuration and enrolled personal authentication.
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe hook forwards a service credential to an unrestricted configured gateway, creating a concrete conditional credential exposure risk. The source does not establish a default malicious recipient or install-time activation, so this warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user generates or writes managed settings and later triggers a Claude PostToolUse event.
Impact
A configured third-party gateway can receive the Anthropic credential.
Mechanism
The hook sends ANTHROPIC_AUTH_TOKEN in a bearer header to the gateway's optimize-output endpoint. The gateway can be configured through ANYRAY_GATEWAY_URL and is not restricted to an Anyray host.
AI rationale
The hook forwards a service credential to an unrestricted configured gateway, creating a concrete conditional credential exposure risk. The source does not establish a default malicious recipient or install-time activation, so this warrants a warning rather than a block.
Evidence
dist/index.js
Network endpoints1
/connect/optimize-output
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package describes routing local coding tools through the Anyray gateway.
- A managed Claude hook forwards ANTHROPIC_AUTH_TOKEN as a bearer credential to the configured gateway.
- The gateway may be supplied through ANYRAY_GATEWAY_URL; HTTPS destinations are accepted without a host allowlist.
- The hook is added when managed settings are generated, so credential forwarding occurs after configuration and a later tool use.
Evidence against
- The manifest has no preinstall, install, or postinstall hook; prepublishOnly runs tests.
- The inspected hook targets the configured gateway's optimize-output path, consistent with the stated gateway integration.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flagged · loading sourcedist/index.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: var v3=Object.defineProperty;var G=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var Xh=(e,t)=>{for(var n in t)v3(e,n,{get:t[n],enumerable:!0})}...
L3: `,{flag:"wx",mode:384}),await Le(l,a)}catch(d){throw await Ni(l,{force:!0}).catch(()=>{}),await Ni(e,{recursive:!0,force:!0}).catch(()=>{}),d}return async()=>{try{JSON.parse(await ...
L4: `,{mode:384}),await kC(a,384);try{await Le(a,n)}catch(s){throw await Ni(a,{force:!0}).catch(()=>{}),s}},Ze=async e=>{if(ey.getStore()===!0){await wC(e);return}let t=await vC();try{...
L5: `;if(a||n.tombstoneAbsent!==!1)try{await KT(r,s)}catch(i){if(i.code!=="EEXIST")throw i}}let o=`${e}.anyray-tmp-${process.pid}-${JT
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L154`);return o.length>0?o+`
L55: `:""},_f=e=>{if(e.trim().length===0)return!0;try{return Tz(e),!0}catch{return!1}}});import{randomUUID as Gz}from"node:crypto";import{chmod as Uz,mkdir as Wz,rm as Kz,writeFile as V...
L56: `)?a.slice(0,-2):a.endsWith(`
High
130}
L131: `,KD=e=>new Promise((t,n)=>{let r=JQ("powershell.exe",["-NoLogo","-NoProfile","-NonInteractive","-Command",n8],{encoding:"utf8",env:rt(),windowsHide:!0,timeout:6e4,maxBuffer:131072...
L132: `))}`]:[],`export ${ES}=${Ke(n)}`]},aM=(e,t,n)=>{let r=Ie({...e.metadata,tool:sc});return["export COPILOT_PROVIDER_TYPE='openai'",`export COPILOT_PROVIDER_BASE_URL=${Ke(e.openaiBas...
High
54`);return o.length>0?o+`
L55: `:""},_f=e=>{if(e.trim().length===0)return!0;try{return Tz(e),!0}catch{return!1}}});import{randomUUID as Gz}from"node:crypto";import{chmod as Uz,mkdir as Wz,rm as Kz,writeFile as V...
L56: `)?a.slice(0,-2):a.endsWith(`
...
L60: `).trim().split(/\r?\n/).at(-1),o=/^([01])\|(-?\d+)\|(-?\d+)$/.exec(r??"");_P(o?.slice(1).map(Number))},t9=(e,t)=>{let n=Zz(IP(zz(),"anyray-cursor-"));try{let o=[".bail on",".timeo...
L61: `);ky("sqlite3",[e],{input:o,encoding:"utf-8",maxBuffer:YC,stdio:["pipe","ignore","pipe"]})}finally{try{Yz(n,{recursive:!0,force:!0})}catch{}}},n9={kind:"sqlite3-cli",readItem:(e,t...
L62: `)},Py=e=>!e.byoUpstream&&!he(e,"anthropic"),Ly="",Lo=(e,t={})=>{let n=e.byoUpstream,r=!n&&he(e,"anthropic"),o=Ie({...e.metadata,tool:e.metadata.tool??"claude-
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L54•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
var v3=Object.defineProperty;var G=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var Xh=(e,t)=>{for(var n in t)v3(e,n,{get:t[n],enumerable:!0})}...
`,{mode:384}),await kC(a,384);try{await Le(a,n)}catch(s){throw await Ni(a,{force:!0}).catch(()=>{}),s}},Ze=async e=>{if(ey.getStore()===!0){await wC(e);return}let t=await vC();try{...
`,r),s=a<0?e.length:a;if(e.slice(o,s).trim()===t)return o;r=e.indexOf(t,r+t.length)}return-1}});import{readFile as q3,writeFile as aP,access as Q3}from"node:fs/promises";import{rea...
`:""},_f=e=>{if(e.trim().length===0)return!0;try{return Tz(e),!0}catch{retur
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg54`);return o.length>0?o+`
L55: `:""},_f=e=>{if(e.trim().length===0)return!0;try{return Tz(e),!0}catch{return!1}}});import{randomUUID as Gz}from"node:crypto";import{chmod as Uz,mkdir as Wz,rm as Kz,writeFile as V...
L56: `)?a.slice(0,-2):a.endsWith(`
...
L60: `).trim().split(/\r?\n/).at(-1),o=/^([01])\|(-?\d+)\|(-?\d+)$/.exec(r??"");_P(o?.slice(1).map(Number))},t9=(e,t)=>{let n=Zz(IP(zz(),"anyray-cursor-"));try{let o=[".bail on",".timeo...
L61: `);ky("sqlite3",[e],{input:o,encoding:"utf-8",maxBuffer:YC,stdio:["pipe","ignore","pipe"]})}finally{try{Yz(n,{recursive:!0,force:!0})}catch{}}},n9={kind:"sqlite3-cli",readItem:(e,t...
L62: `)},Py=e=>!e.byoUpstream&&!he(e,"anthropic"),Ly="",Lo=(e,t={})=>{let n=e.byoUpstream,r=!n&&he(e,"anthropic"),o=Ie({...e.metadata,tool:e.metadata.tool??"claude-
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L5454Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js
L54: `);return o.length>0?o+`
L55: `:""},_f=e=>{if(e.trim().length===0)return!0;try{return Tz(e),!0}catch{return!1}}});import{randomUUID as Gz}from"node:crypto";import{chmod as Uz,mkdir as Wz,rm as Kz,writeFile as V...
L56: `)?a.slice(0,-2):a.endsWith(`
...
L60: `).trim().split(/\r?\n/).at(-1),o=/^([01])\|(-?\d+)\|(-?\d+)$/.exec(r??"");_P(o?.slice(1).map(Number))},t9=(e,t)=>{let n=Zz(IP(zz(),"anyray-cursor-"));try{let o=[".bail on",".timeo...
L61: `);ky("sqlite3",[e],{input:o,encoding:"utf-8",maxBuffer:YC,stdio:["pipe","ignore","pipe"]})}finally{try{Yz(n,{recursive:!0,force:!0})}catch{}}},n9={kind:"sqlite3-cli",readItem:(e,t...
L62: `)},Py=e=>!e.byoUpstream&&!he(e,"anthropic"),Ly="",Lo=(e,t={})=>{let n=e.by
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.jsView on unpkg · L54Findings
1 Critical6 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to anyray-connect@0.11.282.
See all versions of anyray-connect for other recorded verdicts.
- Review the evidence and your use of anyray-connect@0.11.282 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.