registry / @1agents/happy / 20260718.8.0

@1agents/happy@20260718.8.0

happy-cli bundle + adapter (optional; npm ci on install)

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 36 file(s), 1.53 MB of source, external domains: 127.0.0.1, accounts.google.com, api.cluster-fluster.com, api.openai.com, app.happy.engineering, auth.openai.com, claude.ai, console.anthropic.com, developers.google.com, github.com, goo.gle, happy.engineering, oauth2.googleapis.com, registry.npmjs.org, relay.test, www.googleapis.com

Source & flagged code

4 flagged

package.jsonView file

Lines 1-20json

2 "name": "@1agents/happy",

3 "version": "20260718.8.0",

4 "description": "happy-cli bundle + adapter (optional; npm ci on install)",

5 "license": "MIT",

6 "scripts": {

7 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L7

8 },

9 "files": [

10 "happy-cli/",

11 "adapter/",

12 "scripts/",

13 "package.json",

14 "README.md"

15 ],

16 "publishConfig": {

17 "access": "public"

18 }

19}

scripts/postinstall.jsView file

Lines 1-21javascript

1"use strict";

2const { spawnSync } = require("child_process");

3const fs = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/postinstall.js

happy-cli/dist/index-gVuP_P4o.cjsView file

Lines 1-35javascript

1'use strict';

3var chalk = require('chalk');

4var os = require('node:os');

5var node_crypto = require

Source & flagged code

4 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code