Loading npm security reports…

@buzzni/happy-cli@1.1.10-aplus.248: AI-agent control-surface risk | LPM Firewall

registry / @buzzni/happy-cli / 1.1.10-aplus.248

@buzzni/happy-cli@1.1.10-aplus.248

A+ Dev Studio fork of slopus/happy. Mobile and Web client for Claude Code and Codex.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm installation automatically installs third-party AI credential-management tools. The package runtime then accesses their Codex account and settings files.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing this package globally outside CI, unless the skip environment variable is set.

Impact

This mutates a broad AI-agent authentication control surface without an explicit user command or consent prompt.

Mechanism

The postinstall hook launches global npm and uv tool installs, and the runtime reads the installed Codex multi-account state and executes its command.

Policy narrative

A global installation triggers a postinstall script that installs external Codex and Claude credential-management tools into global tool locations. The package later reads Codex multi-account credential state and invokes the installed authentication command. This is an automatic mutation of an AI-agent authentication control surface rather than an explicit setup action.

AI rationale

The automatic global installation and use of third-party AI credential tooling is a concrete, unconsented install-time control-surface mutation. It meets the blocking policy for postinstall changes to a foreign or broad AI-agent control surface.

Evidence

package.jsonscripts/install-companion-tools.cjsdist/main-k4gwYvsS.mjs

Decision evidence

Source & flagged code

23 flagged

package.jsonView file

Lines 87-127json

87 "tools/archives",

88 "tools/licenses",

89 "package.json"

90 ],

91 "scripts": {

92 "cli": "tsx src/index.ts",

93 "dev": "tsx src/index.ts",

94 "typecheck": "tsc --noEmit",

95 "test:browser-poc": "vitest run --project browser-poc",

96 "bundle:server": "node scripts/bundle-server.cjs",

97 "bundle:server:all": "node scripts/bundle-server.cjs --all-platforms",

98 "bundle:webapp": "node scripts/bundle-webapp.cjs",

99 "build": "shx rm -rf dist && tsc --noEmit && pkgroll && node scripts/copy-browser-extension.cjs",

100 "test": "pnpm run build && vitest run --project unit",

101 "test:integration": "pnpm run build && vitest run --project integration-empty --project integration-plan-mode --project integration-authenticated",

102 "cli:install": "node scripts/install-local.cjs",

103 "cli:install:isolated": "node scripts/install-isolated.cjs",

104 "prepare:publish": "node scripts/prepare-publish-package.cjs",

105 "guard:publish": "node scripts/guard-publish-artifact.cjs",

106 "prepublishOnly": "node scripts/assert-publish-tool.cjs && node scripts/guard-publish-artifact.cjs . --install-smoke",

107 "postinstall": "node scripts/verify-bundled-deps.cjs && node scripts/unpack-tools.cjs && node scripts/fix-node-pty-perms.cjs && node scripts/install-companion-tools.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L107

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L107

108 },

109 "dependencies": {

110 "@agentclientprotocol/sdk": "^0.14.1",

111 "@anthropic-ai/claude-agent-sdk": "0.3.276",

112 "@anthropic-ai/sandbox-runtime": "0.0.37",

113 "@anthropic-ai/sdk": "0.96.0",

114 "@buzzni/saycode-cli": "0.6.0",

115 "@modelcontextprotocol/sdk": "1.29.0",

116 "@noble/ed25519": "^3.0.0",

117 "@noble/hashes": "^2.0.1",

118 "@paralleldrive/cuid2": "^2.2.2",

119 "@slopus/happy-wire": "0.1.0",

120 "@stablelib/base64": "^2.0.1",

121 "@stablelib/hex": "^2.0.1",

122 "@types/cross-spawn": "^6.0.6",

123 "@types/http-proxy": "^1.17.17",

124 "@types/qrcode-terminal": "^0.12.2",

125 "@types/react": "^19.2.7",

126 "@types/tmp": "^0.2.6",

127 "ai": "^5.0.107",

bin/happy.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

5import { fileURLToPath } from

dist/types-B2RZNdVF.mjsView file

1595stdio: ["ignore", "ignore", "ignore", "ipc"], L1596: execArgv: ["--max-old-space-size=32"] L1597: });

High

Shell

Package source references shell execution.

dist/types-B2RZNdVF.mjsView on unpkg · L1595

16002return { L16003: async beginImport(request) { L16004: assertValidImportManifest(request.size, request.sha256);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/types-B2RZNdVF.mjsView on unpkg · L16002

scripts/browser-poc/fixture.test.tsView file

Lines 14-45typescript

14async function req(url: string, method = 'GET', body?: unknown, auth = false) {

dist/managedRuntimeBoot-8AZLDzn3.cjsView file

Lines 1-27javascript

1'use strict';

3var node_fs = require('node:fs');

4var path = require('node:path');

5var persistence =

dist/main-k4gwYvsS.mjsView file

1import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import { l as logger, J as getProjectPath, p as projectPath, K as filterCredentialsFr... L2: import chalk from 'chalk'; ... L11: import fs, { watch, access } from 'fs/promises'; L12: import { useStdout, useInput, Box, Text, render } from 'ink'; L13: import axios, { AxiosError } from 'axios'; L14: import net, { Socket, createConnection, createServer, connect } from 'node:net'; L15: import React, { useState, useRef, useEffect, useCallback } from 'react'; L16: import { execFileSync, spawn as spawn$1, execSync, execFile, exec as exec$2 } from 'node:child_process'; L17: import { a as DENIED_IPV4, b as DENIED_IPV6 } from './egressProxy-Bpt-0mt5.mjs'; ... L427: function getClaudeSettingsPath() { L42

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/main-k4gwYvsS.mjsView on unpkg · L1

scripts/sandbox-linux-smoke.tsView file

2Source sends the broad process environment to a literal external destination. L2: import assert from 'node:assert/strict'; L3: import { createServer } from 'node:http'; L4: import { spawn, execFileSync } from 'node:child_process'; L5: import { chmodSync, chownSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'; ... L13: L14: assert.equal(process.platform, 'linux'); L15: assert.equal(process.env.HAPPY_SANDBOX_LINUX_SMOKE, '1'); L16: const uid = (name: string) => Number(execFileSync('/usr/bin/id', ['-u', name], { encoding: 'utf8' }).trim()); ... L23: writeFileSync('/etc/aplus/sandbox-policy.json', '{"mode":"mandatory"}'); L24: writeFileSync('/etc/aplus/claude-sandbox.json', JSON.stringify({ allowedDomains: ['api.anthropic.com', 'platform.claude.com', 'private.allowed.t

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

scripts/sandbox-linux-smoke.tsView on unpkg · L2

dist/main-G-T3-mGN.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @buzzni/happy-cli@1.1.10-aplus.212 matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.212 similarity = 0.683 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/main-G-T3-mGN.cjsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/main-G-T3-mGN.cjs: var node_readline = require('node:readline'); var promises$2 = require('node:readline/promises'); this.claudeEnvVars = opts.claudeEnvVars; this.claudeArgs = opts.claudeArgs; if (!this.claudeArgs) return; for (let i = 0; i < this.claudeArgs.length; i++) { const arg = this.claudeArgs[i]; if (i + 1 < this.claudeArgs.length) {

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/main-G-T3-mGN.cjsView on unpkg

14Cross-file remote execution chain: dist/main-G-T3-mGN.cjs spawns dist/types-CdahdEyd.cjs; helper contains network access plus dynamic code execution. L14: var ink = require('ink'); L15: var axios = require('axios'); L16: var net = require('node:net'); L17: var React = require('react'); L18: var node_child_process = require('node:child_process'); L19: var egressProxy = require('./egressProxy-B5ejDLBy.cjs'); ... L128: if (!input.proposal || typeof input.proposal !== "object" || Array.isArray(input.proposal) || Buffer.byteLength(JSON.stringify(input.proposal), "utf8") > 16384) return { accepted: ... L129: active.proposal = JSON.parse(JSON.stringify(input.proposal)); L130: return { accepted: true }; ... L450: function getClaudeSettingsPath() { L451: const claudeConfigDir = process.env.CLAUDE_C

scripts/browser-poc/rollback.mjsView file

•bounded command output exfiltration = ilesync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileurltopath } from 'node:url';\nconst root = dirname(fileurltopath(import.meta.url));\nconst at = process.argv.indexof('--run'); const run = at >= 0 ? process.argv[at+1] : '';\nif (!/^[a-z0-9][a-z0-9-]{0,39}$/.test(run)) throw error('--run is required');\nconst path = join(root,'.abp',run,'env.json');\nconst reportpath = join(root,'.abp',run,'rollback-report.json');\nif (!existssync(path)) { const old = existssync(reportpath) ? json.parse(readfilesync(reportpath)) : { run, alreadydown:true }; console.log(json.stringify(old)); process.exit(0); }\nconst listed = execfilesync('docker', ['ps','-aq','--filter',`label=ai.saycode.abp-run=${run}`], {encoding:'utf8'}).trim();\nif

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

scripts/browser-poc/rollback.mjsView on unpkg

dist/types-CdahdEyd.cjsView file

•context = ode_fs.existsSync(configuration.daemonStateFile)) {\n return { state: null, raw: null };\n }\n const raw = await fs.readFile(configuration.daemonStateFile, "utf-8");\n return { state: JSON.parse(raw), raw };\n } catch (error) {\n console.error(`[PERSISTENCE] Daemon state file corrupted: ${configuration.daemonStateFile}`, error);\n return { state: null, raw: null };\n }\n}\nasync function readDaemonState() {\n return (await readDaemonStateSnapshot()).state;\n}\nfunction writeDaemonState(state) {\n node_fs.writeFileSync(configuration.daemonStateFile, JSON.stringify(state, null, 2), { encoding: "utf-8", mode: 384 });\n node_fs.chmodSync(configuration.daemonStateFile, 384);\n}\nfunction writeDaemonStateIfUnchanged(expectedRaw, state) {\n const current = node

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/types-CdahdEyd.cjsView on unpkg

2Trigger-reachable chain: manifest.exports -> dist/lib.cjs -> dist/types-CdahdEyd.cjs L2: L3: var axios = require('axios'); L4: var chalk = require('chalk'); ... L16: var fs = require('node:fs/promises'); L17: var node_child_process = require('node:child_process'); L18: var path$1 = require('path'); ... L153: "tools/licenses", L154: "package.json" L155: ]; ... L184: "@slopus/happy-wire": "file:../happy-wire", L185: "@stablelib/base64": "^2.0.1", L186: "@stablelib/hex": "^2.0.1",

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/types-CdahdEyd.cjsView on unpkg · L2

scripts/script-egress-proxy.test.mjsView file

5test('resolves and pins only registered public destinations', async () => { L6: assert.equal(await authorizeDestination('https://example.com', ['https://example.com'], [], async () => ['93.184.216.34']), '93.184.216.34'); L7: await assert.rejects(authorizeDestination('https://other.com', ['https://example.com'], [], async () => ['93.184.216.34']), /ORIGIN_DENIED/); L8: }); L9: test('blocks metadata, loopback, RFC1918, carrier NAT and mixed public/private DNS answers', async () => { L10: for (const address of ['127.0.0.1', '169.254.169.254', '10.0.0.1', '172.16.0.1', '192.168.0.1', '100.64.0.1', '0.0.0.0', '224.0.0.1', '::1']) { ... L16: await assert.rejects(authorizeDestination('http://db:8090', [], ['http://db:8090'], async () => ['172.18.0.2']), /ORIGIN_DENIED/); L17: await assert.re

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

scripts/script-egress-proxy.test.mjsView on unpkg · L5

scripts/agent-browser/images/browser-entrypoint.shView file

•path = scripts/agent-browser/images/browser-entrypoint.sh kind = build_helper sizeBytes = 1786 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/agent-browser/images/browser-entrypoint.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/electronGuiPreload.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/electronGuiPreload.cjs#virtual:normalized:round1View on unpkg

dist/lib.mjsView file

•matchType = token_shingles matchedPackage = @buzzni/happy-cli@1.1.10-aplus.113 matchedPath = dist/lib.mjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.113 similarity = 0.792 shingleOverlap = 38 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.mjsView on unpkg

Source & flagged code

23 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/verify-bundled-deps.cjs && node scripts/unpack-tools.cjs && node scripts/fix-node-pty-perms.cjs && node scripts/install-companion-tools.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/verify-bundled-deps.cjs && node scripts/unpack-tools.cjs && node scripts/fix-node-pty-perms.cjs && node scripts/install-companion-tools.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/happy.mjsView file

2L3: import { execFileSync } from 'child_process'; L4: import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

dist/types-B2RZNdVF.mjsView file

1595stdio: ["ignore", "ignore", "ignore", "ipc"], L1596: execArgv: ["--max-old-space-size=32"] L1597: });

High

Shell

Package source references shell execution.

dist/types-B2RZNdVF.mjsView on unpkg · L1595

16002return { L16003: async beginImport(request) { L16004: assertValidImportManifest(request.size, request.sha256);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/types-B2RZNdVF.mjsView on unpkg · L16002

scripts/browser-poc/fixture.test.tsView file

34for (const match of body.matchAll(/<script>([\s\S]*?)<\/script>/g)) { L35: expect(() => new Function(match[1]), `${path} script`).not.toThrow() L36: }

High

Eval

Package source references dynamic code evaluation.

scripts/browser-poc/fixture.test.tsView on unpkg · L34

dist/managedRuntimeBoot-8AZLDzn3.cjsView file

7var crypto = require('node:crypto'); L8: var http = require('node:http'); L9: var node_child_process = require('node:child_process'); L10: var fs = require('node:fs/promises'); ... L53: require('./egressProxy-B5ejDLBy.cjs'); L54: require('node:dns/promises'); L55: require('@anthropic-ai/claude-agent-sdk'); ... L112: } L113: return { quiesced: true, exitCode: 0, signal: null, providerState }; L114: } ... L320: try { L321: parsed = JSON.parse(raw.toString("utf8"));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/managedRuntimeBoot-8AZLDzn3.cjsView on unpkg · L7

dist/main-k4gwYvsS.mjsView file

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/main-k4gwYvsS.mjsView on unpkg · L1

scripts/sandbox-linux-smoke.tsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

scripts/sandbox-linux-smoke.tsView on unpkg · L2

dist/main-G-T3-mGN.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/main-G-T3-mGN.cjsView on unpkg

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/main-G-T3-mGN.cjsView on unpkg

scripts/browser-poc/rollback.mjsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

scripts/browser-poc/rollback.mjsView on unpkg

dist/types-CdahdEyd.cjsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/types-CdahdEyd.cjsView on unpkg

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/types-CdahdEyd.cjsView on unpkg · L2

scripts/script-egress-proxy.test.mjsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

scripts/script-egress-proxy.test.mjsView on unpkg · L5

scripts/agent-browser/images/browser-entrypoint.shView file

•path = scripts/agent-browser/images/browser-entrypoint.sh kind = build_helper sizeBytes = 1786 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/agent-browser/images/browser-entrypoint.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/electronGuiPreload.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/electronGuiPreload.cjs#virtual:normalized:round1View on unpkg

dist/lib.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.mjsView on unpkg

Source & flagged code

23 flagged

package.jsonView file

Lines 87-127json

87 "tools/archives",

88 "tools/licenses",

89 "package.json"

90 ],

91 "scripts": {

92 "cli": "tsx src/index.ts",

93 "dev": "tsx src/index.ts",

94 "typecheck": "tsc --noEmit",

95 "test:browser-poc": "vitest run --project browser-poc",

96 "bundle:server": "node scripts/bundle-server.cjs",

97 "bundle:server:all": "node scripts/bundle-server.cjs --all-platforms",

98 "bundle:webapp": "node scripts/bundle-webapp.cjs",

99 "build": "shx rm -rf dist && tsc --noEmit && pkgroll && node scripts/copy-browser-extension.cjs",

100 "test": "pnpm run build && vitest run --project unit",

101 "test:integration": "pnpm run build && vitest run --project integration-empty --project integration-plan-mode --project integration-authenticated",

102 "cli:install": "node scripts/install-local.cjs",

103 "cli:install:isolated": "node scripts/install-isolated.cjs",

104 "prepare:publish": "node scripts/prepare-publish-package.cjs",

105 "guard:publish": "node scripts/guard-publish-artifact.cjs",

106 "prepublishOnly": "node scripts/assert-publish-tool.cjs && node scripts/guard-publish-artifact.cjs . --install-smoke",

107 "postinstall": "node scripts/verify-bundled-deps.cjs && node scripts/unpack-tools.cjs && node scripts/fix-node-pty-perms.cjs && node scripts/install-companion-tools.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L107

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L107

108 },

109 "dependencies": {

110 "@agentclientprotocol/sdk": "^0.14.1",

111 "@anthropic-ai/claude-agent-sdk": "0.3.276",

112 "@anthropic-ai/sandbox-runtime": "0.0.37",

113 "@anthropic-ai/sdk": "0.96.0",

114 "@buzzni/saycode-cli": "0.6.0",

115 "@modelcontextprotocol/sdk": "1.29.0",

116 "@noble/ed25519": "^3.0.0",

117 "@noble/hashes": "^2.0.1",

118 "@paralleldrive/cuid2": "^2.2.2",

119 "@slopus/happy-wire": "0.1.0",

120 "@stablelib/base64": "^2.0.1",

121 "@stablelib/hex": "^2.0.1",

122 "@types/cross-spawn": "^6.0.6",

123 "@types/http-proxy": "^1.17.17",

124 "@types/qrcode-terminal": "^0.12.2",

125 "@types/react": "^19.2.7",

126 "@types/tmp": "^0.2.6",

127 "ai": "^5.0.107",

bin/happy.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

5import { fileURLToPath } from

dist/types-B2RZNdVF.mjsView file

1595stdio: ["ignore", "ignore", "ignore", "ipc"], L1596: execArgv: ["--max-old-space-size=32"] L1597: });

High

Shell

Package source references shell execution.

dist/types-B2RZNdVF.mjsView on unpkg · L1595

16002return { L16003: async beginImport(request) { L16004: assertValidImportManifest(request.size, request.sha256);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/types-B2RZNdVF.mjsView on unpkg · L16002

scripts/browser-poc/fixture.test.tsView file

Lines 14-45typescript

14async function req(url: string, method = 'GET', body?: unknown, auth = false) {

dist/managedRuntimeBoot-8AZLDzn3.cjsView file

Lines 1-27javascript

1'use strict';

3var node_fs = require('node:fs');

4var path = require('node:path');

5var persistence =

dist/main-k4gwYvsS.mjsView file

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/main-k4gwYvsS.mjsView on unpkg · L1

scripts/sandbox-linux-smoke.tsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

scripts/sandbox-linux-smoke.tsView on unpkg · L2

dist/main-G-T3-mGN.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/main-G-T3-mGN.cjsView on unpkg

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/main-G-T3-mGN.cjsView on unpkg

scripts/browser-poc/rollback.mjsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

scripts/browser-poc/rollback.mjsView on unpkg

dist/types-CdahdEyd.cjsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/types-CdahdEyd.cjsView on unpkg

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/types-CdahdEyd.cjsView on unpkg · L2

scripts/script-egress-proxy.test.mjsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

scripts/script-egress-proxy.test.mjsView on unpkg · L5

scripts/agent-browser/images/browser-entrypoint.shView file

•path = scripts/agent-browser/images/browser-entrypoint.sh kind = build_helper sizeBytes = 1786 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/agent-browser/images/browser-entrypoint.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/electronGuiPreload.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/electronGuiPreload.cjs#virtual:normalized:round1View on unpkg

dist/lib.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.mjsView on unpkg

@buzzni/happy-cli@1.1.10-aplus.248

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code