anyray-connect@0.11.418
Anyray connect — points local coding tools (Claude Code, Cursor, Windsurf, SDKs) at the Anyray gateway through supported configuration and enrolled personal authentication.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe managed hook forwards Claude’s existing authentication token to a configurable HTTP(S) gateway without a destination allowlist. Because hook setup is user or administrator initiated and the default gateway is local, the source supports a warning for conditional credential exposure rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Managed settings include the HTTP hook and Claude Code invokes it.
Impact
A gateway outside the intended service can receive a reusable Claude credential.
Mechanism
The hook sets the Authorization header from ANTHROPIC_AUTH_TOKEN and sends the request to the configured gateway; gateway validation does not restrict the destination to an allowlist.
AI rationale
The managed hook forwards Claude’s existing authentication token to a configurable HTTP(S) gateway without a destination allowlist. Because hook setup is user or administrator initiated and the default gateway is local, the source supports a warning for conditional credential exposure rather than a publish block.
Evidence
dist/index.js
Decision evidence
public snapshotAI called this Suspicious at 95.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest points the CLI and runtime module to dist/index.js; its publication scripts include prepack and prepublishOnly, with no npm install hook.
- Managed settings can create an HTTP hook that places Claude’s existing ANTHROPIC_AUTH_TOKEN in the Authorization header for the configured gateway.
- The gateway defaults to localhost, but the source accepts HTTP or HTTPS gateway URLs, including an ANYRAY_GATEWAY_URL override.
- A separate runtime path posts tool and output data to the configured gateway only after checking its hook-stash lane.
- The Codex-related code resolves a local hooks.json path alongside its config.toml file.
Evidence against
- The credential-forwarding path requires managed hook configuration and a host invoking that hook; it is not triggered by npm installation.
- The default gateway is local, and the gateway destination can be configured.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flagged · loading sourcedist/index.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: var $re=Object.defineProperty;var F=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var vm=(e,t)=>{for(var n in t)$re(e,n,{get:t[n],enumerable:!0}...
L3: `,{flag:"wx",mode:384}),await ze(f,a)}catch(p){throw await pl(f,{force:!0}).catch(()=>{}),await pl(e,{recursive:!0,force:!0}).catch(()=>{}),p}return async()=>{try{JSON.parse(await ...
L4: `,{mode:384}),await EB(a,384),await ze(a,n)}catch(s){throw await xE(a).catch(()=>{}),s}},Tt=async(e,t={})=>{if(Jw.getStore()===!0){await IE(e,t);return}let n=await LE();try{await I...
L5: `)){let r=n.trim();if(r.startsWith("Settings"))for(let o of["REG_EXPAND_SZ","REG_SZ"]){let a=r.indexOf(`${o} `);if(a>0)return r.s
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L13`,{flag:"wx",mode:384}),await ze(f,a)}catch(p){throw await pl(f,{force:!0}).catch(()=>{}),await pl(e,{recursive:!0,force:!0}).catch(()=>{}),p}return async()=>{try{JSON.parse(await ...
L4: `,{mode:384}),await EB(a,384),await ze(a,n)}catch(s){throw await xE(a).catch(()=>{}),s}},Tt=async(e,t={})=>{if(Jw.getStore()===!0){await IE(e,t);return}let n=await LE();try{await I...
L5: `)){let r=n.trim();if(r.startsWith("Settings"))for(let o of["REG_EXPAND_SZ","REG_SZ"]){let a=r.indexOf(`${o} `);if(a>0)return r.slice(a+o.length).trim()}}return}catch{return}},NE=...
High
66`)):h&&k&&await $b(u,{force:!0}),await ub(n,m)}catch(C){try{b!==void 0&&k?await Ye(u,b):k&&await $b(u,{force:!0})}catch{throw new Error("shell environment update failed and credent...
L67: `,{mode:384}),await ze(n,t)},Nx=(e,t)=>e.generation||t.generation?!!(e.generation&&e.generation===t.generation):e.op===t.op&&e.requestedAt===t.requestedAt&&e.watcherPid===t.watcher...
L68: `),$ie=e=>{let t=Lie(e);for(;;){if(Vt(Ru(t,".git")))return t;let n=XU(t);if(n===t)return null;t=n}},Bie=e=>e.authMode!=="placeholder",Da=()=>Ru(YU(),".cursor","hooks.json"),ea=()=>...
High
1#!/usr/bin/env node
L2: var $re=Object.defineProperty;var F=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var vm=(e,t)=>{for(var n in t)$re(e,n,{get:t[n],enumerable:!0}...
L3: `,{flag:"wx",mode:384}),await ze(f,a)}catch(p){throw await pl(f,{force:!0}).catch(()=>{}),await pl(e,{recursive:!0,force:!0}).catch(()=>{}),p}return async()=>{try{JSON.parse(await ...
L4: `,{mode:384}),await EB(a,384),await ze(a,n)}catch(s){throw await xE(a).catch(()=>{}),s}},Tt=async(e,t={})=>{if(Jw.getStore()===!0){await IE(e,t);return}let n=await LE();try{await I...
L5: `)){let r=n.trim();if(r.startsWith("Settings"))for(let o of["REG_EXPAND_SZ","REG_SZ"]){let a=r.indexOf(`${o} `);if(a>0)return r.slice(a+o.length).trim()}}return}catch{return}},NE=...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L1•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
var $re=Object.defineProperty;var F=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var vm=(e,t)=>{for(var n in t)$re(e,n,{get:t[n],enumerable:!0}...
`,{flag:"wx",mode:384}),await ze(f,a)}catch(p){throw await pl(f,{force:!0}).catch(()=>{}),await pl(e,{recursive:!0,force:!0}).catch(()=>{}),p}return async()=>{try{JSON.parse(await ...
`,{mode:384}),await EB(a,384),await ze(a,n)}catch(s){throw await xE(a).catch(()=>{}),s}},Tt=async(e,t={})=>{if(Jw.getStore()===!0){await IE(e,t);return}let n=await LE();try{await I...
`)){let r=n.trim();if(r.startsWith("Settings"))for(let o of["REG_EXPAND_SZ",
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg1#!/usr/bin/env node
L2: var $re=Object.defineProperty;var F=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var vm=(e,t)=>{for(var n in t)$re(e,n,{get:t[n],enumerable:!0}...
L3: `,{flag:"wx",mode:384}),await ze(f,a)}catch(p){throw await pl(f,{force:!0}).catch(()=>{}),await pl(e,{recursive:!0,force:!0}).catch(()=>{}),p}return async()=>{try{JSON.parse(await ...
L4: `,{mode:384}),await EB(a,384),await ze(a,n)}catch(s){throw await xE(a).catch(()=>{}),s}},Tt=async(e,t={})=>{if(Jw.getStore()===!0){await IE(e,t);return}let n=await LE();try{await I...
L5: `)){let r=n.trim();if(r.startsWith("Settings"))for(let o of["REG_EXPAND_SZ","REG_SZ"]){let a=r.indexOf(`${o} `);if(a>0)return r.slice(a+o.length).trim()}}return}catch{return}},NE=...
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L11Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js
L1: #!/usr/bin/env node
L2: var $re=Object.defineProperty;var F=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var vm=(e,t)=>{for(var n in t)$re(e,n,{get:t[n],enumerable:!0}...
L3: `,{flag:"wx",mode:384}),await ze(f,a)}catch(p){throw await pl(f,{force:!0}).catch(()=>{}),await pl(e,{recursive:!0,force:!0}).catch(()=>{}),p}return async()=>{try{JSON.parse(await ...
L4: `,{mode:384}),await EB(a,384),await ze(a,n)}catch(s){throw await xE(a).catch(()=>{}),s}},Tt=async(e,t={})=>{if(Jw.getStore()===!0){await IE(e,t);return}let n=await LE();try{await I...
L5: `)){let r=n.trim();if(r.startsWith("Settings"))for(let o of["REG_EXPAND_SZ","REG_SZ"]){let a=r.indexOf(`${o} `);if(a>0)retu
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.jsView on unpkg · L1Findings
1 Critical6 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to anyray-connect@0.11.418.
See all versions of anyray-connect for other recorded verdicts.
- Review the evidence and your use of anyray-connect@0.11.418 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.