registry / Credential exfiltration / anyray-connect / 0.11.436

anyray-connect@0.11.436

Anyray connect — points local coding tools (Claude Code, Cursor, Windsurf, SDKs) at the Anyray gateway through supported configuration and enrolled personal authentication.

AI Security Review

scanned 22h ago · by lpm-firewall-ai

The bundled CLI provides a conditional subscription-routing feature that forwards a saved Claude token through a configurable gateway. This is a concrete credential-exposure risk, but the inspected source does not establish malicious intent or justify a publication block.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Claude Desktop is set up for subscription routing and invokes the credential helper.

Impact

The gateway receives a Claude subscription credential, creating conditional credential exposure when the destination is not trusted.

Mechanism

The helper reads a token from the Claude login keychain and returns it with Anyray gateway headers; the configured gateway accepts a user-selected HTTP or HTTPS URL.

AI rationale

Evidence

dist/index.js

Network endpoints1

localhost:8787

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json exposes dist/index.js as the CLI and main entrypoint.
The Claude Desktop helper reads an existing Claude subscription token from the login keychain and emits it with gateway headers.
The Claude Desktop profile uses the configured gateway URL and helper for subscription routing.
Gateway selection accepts HTTP or HTTPS URLs, including ANYRAY_GATEWAY_URL.
Claude Desktop subscription routing activates the helper path.

Evidence against

The transfer is conditional on Claude Desktop subscription routing and occurs through a helper at request time.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1.56 MB of source, external domains: api.anthropic.com, api.github.com, api.githubcopilot.com, api.openai.com, app.anyray.ai, chatgpt.com, claude.ai, docs.anyray.ai, github.com, gw.acme.com, opencode.ai, www.apple.com

Source & flagged code

8 flagged

dist/index.jsView file

1Source sends the broad process environment to a literal external destination. L1: #!/usr/bin/env node L2: var bce=Object.defineProperty;var B=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var Rh=(e,t)=>{for(var n in t)bce(e,n,{get:t[n],enumerable:!0}... L3: `,{flag:"wx",mode:384}),await nt(f,a)}catch(p){throw await Zl(f,{force:!0}).catch(()=>{}),await Zl(e,{recursive:!0,force:!0}).catch(()=>{}),p}return async()=>{try{JSON.parse(await ... ... L44: `);return o.length>0?o+` L45: `:""},sf=e=>{if(e.trim().length===0)return!0;try{return Ok(e),!0}catch{return!1}},H1=(e,t)=>{Ok(e);let n=e.split(/(?<=\n)/),r=ii(n.map(i=>i.replace(/\r?\n$/,""))),o=[],a=0,s;for(le... L46: `)?a.slice(0,-2):a.endsWith(` ... L50: `).trim().split(/\r?\n/).at(-1),o=/^([01])\|(-?\d+)\|(-

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = anyray-connect@0.11.419 matchedIdentity = npm:YW55cmF5LWNvbm5lY3Q:0.11.419 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

44`);return o.length>0?o+` L45: `:""},sf=e=>{if(e.trim().length===0)return!0;try{return Ok(e),!0}catch{return!1}},H1=(e,t)=>{Ok(e);let n=e.split(/(?<=\n)/),r=ii(n.map(i=>i.replace(/\r?\n$/,""))),o=[],a=0,s;for(le... L46: `)?a.slice(0,-2):a.endsWith(`

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L44

54`:a.trim()&&e(a),t=t.slice(o+1),o=t.indexOf(` L55: `)}},stdout:()=>n+t}},aue=async e=>{let t=await gf();if(!t)throw new Error("missing-claude");let n=process.platform==="win32"&&/\.cmd$/i.test(t),r=n?process.env.ComSpec??"cmd.exe":... L56: `))}catch(a){return{status:(a instanceof Error?a.message:"")==="missing-claude"?"missing-claude":"mint-failed"}}let r;for(let a of n.split(/\r?\n/)){let s=OH.exec(a);s&&RH.test(s[0...

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L54

67`);if(t[0]?.trimEnd()!=="---")return!1;let n=t.findIndex((o,a)=>a>0&&o.trimEnd()==="---");if(n<0)return!1;let r=t.slice(1,n).join(` L68: `);try{let o=wG(r,{uniqueKeys:!1,logLevel:"error"});return Ie(o)&&Object.keys(o).some(a=>/^hooks$/i.test(a))}catch{return/^hooks\s*:/im.test(r)}},Yue=200,gG=async e=>{try{return(aw... L69: `,` ... L71: `);if(n[0].trimEnd()!=="---")return!1;let r=n.findIndex((a,s)=>s>0&&a.trimEnd()==="---");if(r<0)return!1;let o;try{o=nfe(n.slice(1,r).join(` L72: `),{uniqueKeys:!1})}catch{return!1}return Zr(o)&&vG(o.name)&&vG(o.description)},RG=(e,t)=>[...new Set(e)].filter(n=>!t.has(n)).sort(),lfe=async e=>{let t=await gf();if(!t)return!1;... L73: `,zI=8,QG=256,eW=e=>Array.from(e).length>QG,Lfe=(e,t)=>e.some(({entry:n})=>eW(t[n-1]))||["file_too_large","source_too_lar

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L67

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: var bce=Object.defineProperty;var B=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var Rh=(e,t)=>{for(var n in t)bce(e,n,{get:t[n],enumerable:!0}... `,{flag:"wx",mode:384}),await nt(f,a)}catch(p){throw await Zl(f,{force:!0}).catch(()=>{}),await Zl(e,{recursive:!0,force:!0}).catch(()=>{}),p}return async()=>{try{JSON.parse(await ... `,{mode:384}),await n1(a,384),await nt(a,n)}catch(s){throw await T0(a).catch(()=>{}),s}},Ut=async(e,t={})=>{if(hk.getStore()===!0){await P0(e,t);return}let n=await $0();try{await P... `)},Sc=async()=>{await qce(ef(),{force:!0})},_k=async()=>{await zce(ef(),`${

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

71`);if(n[0].trimEnd()!=="---")return!1;let r=n.findIndex((a,s)=>s>0&&a.trimEnd()==="---");if(r<0)return!1;let o;try{o=nfe(n.slice(1,r).join(` L72: `),{uniqueKeys:!1})}catch{return!1}return Zr(o)&&vG(o.name)&&vG(o.description)},RG=(e,t)=>[...new Set(e)].filter(n=>!t.has(n)).sort(),lfe=async e=>{let t=await gf();if(!t)return!1;... L73: `,zI=8,QG=256,eW=e=>Array.from(e).length>QG,Lfe=(e,t)=>e.some(({entry:n})=>eW(t[n-1]))||["file_too_large","source_too_large"].some(n=>e.filter(r=>r.code===n).length>zI),Nfe=(e,t,n)... L74: `,m=(C,S)=>{let E=(()=>{try{return f.read(S,i?fy:kA)}catch(I){return tW(I,i,C+1)}})();return rW(E,C+1)},h=(C,S)=>{let{content:E,byteLength:I}=m(C,S);if(!i)return{body:E,bodyBytes:I... L75: `);D.at(-1)===""&&D.pop(),U>D.length&&_n("range_outside_file",C+1);let $=D.slice(U

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L71

71Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js L71: `);if(n[0].trimEnd()!=="---")return!1;let r=n.findIndex((a,s)=>s>0&&a.trimEnd()==="---");if(r<0)return!1;let o;try{o=nfe(n.slice(1,r).join(` L72: `),{uniqueKeys:!1})}catch{return!1}return Zr(o)&&vG(o.name)&&vG(o.description)},RG=(e,t)=>[...new Set(e)].filter(n=>!t.has(n)).sort(),lfe=async e=>{let t=await gf();if(!t)return!1;... L73: `,zI=8,QG=256,eW=e=>Array.from(e).length>QG,Lfe=(e,t)=>e.some(({entry:n})=>eW(t[n-1]))||["file_too_large","source_too_large"].some(n=>e.filter(r=>r.code===n).length>zI),Nfe=(e,t,n)... L74: `,m=(C,S)=>{let E=(()=>{try{return f.read(S,i?fy:kA)}catch(I){return tW(I,i,C+1)}})();return rW(E,C+1)},h=(C,S)=>{let{content:E,byteLength:I}=m(C,S);if(!i)return{body:E,bodyBytes:I... L75

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L71

Source & flagged code

8 flagged · loading source

dist/index.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L1

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L44

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L54

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L67

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L71

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L71

Findings

2 Critical6 High3 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/index.js

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/index.js

HighShelldist/index.js

HighSame File Env Network Executiondist/index.js

HighCredential Redirect Persistencedist/index.js

HighCommand Output Exfiltrationdist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to anyray-connect@0.11.436.

See all versions of anyray-connect for other recorded verdicts.

Review the evidence and your use of anyray-connect@0.11.436 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 06:14:57.286Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.