anyray-connect@0.11.419
Anyray connect — points local coding tools (Claude Code, Cursor, Windsurf, SDKs) at the Anyray gateway through supported configuration and enrolled personal authentication.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThis is conditional exposure of an existing service credential to an unrestricted configured gateway, so it warrants a warning rather than a block. The behavior requires explicit managed setup; no npm install hook or concrete malicious use was identified.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
An administrator runs anyray-connect managed --write, then Claude Code invokes the generated PostToolUse hook.
Impact
The configured gateway operator may receive the Anthropic token. The source establishes conditional forwarding, not misuse of the token.
Mechanism
The generated HTTP hook includes ANTHROPIC_AUTH_TOKEN as bearer authorization when posting to the gateway optimization route.
AI rationale
This is conditional exposure of an existing service credential to an unrestricted configured gateway, so it warrants a warning rather than a block. The behavior requires explicit managed setup; no npm install hook or concrete malicious use was identified.
Evidence
dist/index.js
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The indicated Codex integration location resolves to its config and hook files under CODEX_HOME or .codex.
- The managed Claude Code hook sends requests to the gateway optimization route with ANTHROPIC_AUTH_TOKEN as bearer authorization.
- The managed settings builder attaches that hook to PostToolUse using the configured gateway origin.
- Gateway validation permits any HTTP or HTTPS origin and does not restrict the destination host.
- The hook is written through managed --write, a root-only administrative command.
- The manifest has no preinstall, install, or postinstall hook; prepublishOnly runs tests.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flagged · loading sourcedist/index.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: var aoe=Object.defineProperty;var F=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var xm=(e,t)=>{for(var n in t)aoe(e,n,{get:t[n],enumerable:!0}...
L3: `,{flag:"wx",mode:384}),await Qe(f,a)}catch(p){throw await yl(f,{force:!0}).catch(()=>{}),await yl(e,{recursive:!0,force:!0}).catch(()=>{}),p}return async()=>{try{JSON.parse(await ...
L4: `,{mode:384}),await FB(a,384),await Qe(a,n)}catch(s){throw await TE(a).catch(()=>{}),s}},Tt=async(e,t={})=>{if(tb.getStore()===!0){await PE(e,t);return}let n=await $E();try{await P...
L5: `)){let r=n.trim();if(r.startsWith("Settings"))for(let o of["REG_EXPAND_SZ","REG_SZ"]){let a=r.indexOf(`${o} `);if(a>0)return r.s
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L1•matchType = previous_version_dangerous_delta
matchedPackage = anyray-connect@0.11.418
matchedIdentity = npm:YW55cmF5LWNvbm5lY3Q:0.11.418
similarity = 0.667
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg3`,{flag:"wx",mode:384}),await Qe(f,a)}catch(p){throw await yl(f,{force:!0}).catch(()=>{}),await yl(e,{recursive:!0,force:!0}).catch(()=>{}),p}return async()=>{try{JSON.parse(await ...
L4: `,{mode:384}),await FB(a,384),await Qe(a,n)}catch(s){throw await TE(a).catch(()=>{}),s}},Tt=async(e,t={})=>{if(tb.getStore()===!0){await PE(e,t);return}let n=await $E();try{await P...
L5: `)){let r=n.trim();if(r.startsWith("Settings"))for(let o of["REG_EXPAND_SZ","REG_SZ"]){let a=r.indexOf(`${o} `);if(a>0)return r.slice(a+o.length).trim()}}return}catch{return}},BE=...
High
66`)):y&&k&&await Gb(u,{force:!0}),await yb(n,m)}catch(C){try{b!==void 0&&k?await Je(u,b):k&&await Gb(u,{force:!0})}catch{throw new Error("shell environment update failed and credent...
L67: `,{mode:384}),await Qe(n,t)},Bx=(e,t)=>e.generation||t.generation?!!(e.generation&&e.generation===t.generation):e.op===t.op&&e.requestedAt===t.requestedAt&&e.watcherPid===t.watcher...
L68: `),ace=e=>{let t=tce(e);for(;;){if(Vt(Pu(t,".git")))return t;let n=c1(t);if(n===t)return null;t=n}},sce=e=>e.authMode!=="placeholder",$a=()=>Pu(i1(),".cursor","hooks.json"),na=()=>...
High
1#!/usr/bin/env node
L2: var aoe=Object.defineProperty;var F=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var xm=(e,t)=>{for(var n in t)aoe(e,n,{get:t[n],enumerable:!0}...
L3: `,{flag:"wx",mode:384}),await Qe(f,a)}catch(p){throw await yl(f,{force:!0}).catch(()=>{}),await yl(e,{recursive:!0,force:!0}).catch(()=>{}),p}return async()=>{try{JSON.parse(await ...
L4: `,{mode:384}),await FB(a,384),await Qe(a,n)}catch(s){throw await TE(a).catch(()=>{}),s}},Tt=async(e,t={})=>{if(tb.getStore()===!0){await PE(e,t);return}let n=await $E();try{await P...
L5: `)){let r=n.trim();if(r.startsWith("Settings"))for(let o of["REG_EXPAND_SZ","REG_SZ"]){let a=r.indexOf(`${o} `);if(a>0)return r.slice(a+o.length).trim()}}return}catch{return}},BE=...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L1•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
var aoe=Object.defineProperty;var F=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var xm=(e,t)=>{for(var n in t)aoe(e,n,{get:t[n],enumerable:!0}...
`,{flag:"wx",mode:384}),await Qe(f,a)}catch(p){throw await yl(f,{force:!0}).catch(()=>{}),await yl(e,{recursive:!0,force:!0}).catch(()=>{}),p}return async()=>{try{JSON.parse(await ...
`,{mode:384}),await FB(a,384),await Qe(a,n)}catch(s){throw await TE(a).catch(()=>{}),s}},Tt=async(e,t={})=>{if(tb.getStore()===!0){await PE(e,t);return}let n=await $E();try{await P...
`)){let r=n.trim();if(r.startsWith("Settings"))for(let o of["REG_EXPAND_SZ",
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg1#!/usr/bin/env node
L2: var aoe=Object.defineProperty;var F=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var xm=(e,t)=>{for(var n in t)aoe(e,n,{get:t[n],enumerable:!0}...
L3: `,{flag:"wx",mode:384}),await Qe(f,a)}catch(p){throw await yl(f,{force:!0}).catch(()=>{}),await yl(e,{recursive:!0,force:!0}).catch(()=>{}),p}return async()=>{try{JSON.parse(await ...
L4: `,{mode:384}),await FB(a,384),await Qe(a,n)}catch(s){throw await TE(a).catch(()=>{}),s}},Tt=async(e,t={})=>{if(tb.getStore()===!0){await PE(e,t);return}let n=await $E();try{await P...
L5: `)){let r=n.trim();if(r.startsWith("Settings"))for(let o of["REG_EXPAND_SZ","REG_SZ"]){let a=r.indexOf(`${o} `);if(a>0)return r.slice(a+o.length).trim()}}return}catch{return}},BE=...
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L11Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js
L1: #!/usr/bin/env node
L2: var aoe=Object.defineProperty;var F=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var xm=(e,t)=>{for(var n in t)aoe(e,n,{get:t[n],enumerable:!0}...
L3: `,{flag:"wx",mode:384}),await Qe(f,a)}catch(p){throw await yl(f,{force:!0}).catch(()=>{}),await yl(e,{recursive:!0,force:!0}).catch(()=>{}),p}return async()=>{try{JSON.parse(await ...
L4: `,{mode:384}),await FB(a,384),await Qe(a,n)}catch(s){throw await TE(a).catch(()=>{}),s}},Tt=async(e,t={})=>{if(tb.getStore()===!0){await PE(e,t);return}let n=await $E();try{await P...
L5: `)){let r=n.trim();if(r.startsWith("Settings"))for(let o of["REG_EXPAND_SZ","REG_SZ"]){let a=r.indexOf(`${o} `);if(a>0)retu
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.jsView on unpkg · L1Findings
2 Critical6 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to anyray-connect@0.11.419.
See all versions of anyray-connect for other recorded verdicts.
- Review the evidence and your use of anyray-connect@0.11.419 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.