registry / @buzzni/happy-cli / 1.1.10-aplus.253

@buzzni/happy-cli@1.1.10-aplus.253

A+ Dev Studio fork of slopus/happy. Mobile and Web client for Claude Code and Codex.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

A postinstall hook can add two companion command-line tools during a global package installation. No confirmed credential theft or agent-control hijack was found.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing this package globally outside CI without the opt-out environment variable.

Impact

It can modify the user's global command-line tool environment without a separate interactive consent step.

Mechanism

The lifecycle hook launches fixed npm and uv global-tool installation commands.

AI rationale

The automatic global companion-tool installation is concrete install-hook abuse, though its constrained and transparent implementation does not meet the block threshold. The inspected agent-related checkpoint code excludes credential material.

Evidence

package.jsonscripts/install-companion-tools.cjs

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs install-companion-tools.cjs automatically from postinstall.
On non-CI global installs, the hook invokes npm to globally install codex-multi-auth and invokes uv to install claude-swap.
The runtime checkpoint filter excludes credential paths rather than including them.

Evidence against

The companion installation is limited to global npm installs, can be disabled with an environment flag, and uses fixed package/version arguments.
No hidden endpoint, credential send operation, self-dependency, or broad agent-configuration write was established in the inspected paths.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 108 file(s), 6.82 MB of source, external domains: 127.0.0.1, a.poc-one.test, accounts.google.com, api.anthropic.com, api.cluster-fluster.com, api.deepseek.com, api.openai.com, api.z.ai, auth.openai.com, b.poc-two.test, bridge.invalid, c.poc-three.test, claude.ai, console.anthropic.com, dev-studio.example, developers.google.com, dl.google.com, example.com, example.invalid, feed.test, github.com, goo.gle, happy.engineering, huggingface.co, oauth2.googleapis.com, openbox.org, other.com, platform.claude.com, private.allowed.test, prod-studio.example, registry.npmjs.org, saycode.ai, shop.example, studio.example, tunnel.example, www.apple.com, www.googleapis.com

Source & flagged code

34 flagged

package.jsonView file

Lines 89-129json

89 "tools/archives",

90 "tools/licenses",

91 "package.json"

92 ],

93 "scripts": {

94 "cli": "tsx src/index.ts",

95 "dev": "tsx src/index.ts",

96 "typecheck": "tsc --noEmit",

97 "test:browser-poc": "vitest run --project browser-poc",

98 "bundle:server": "node scripts/bundle-server.cjs",

99 "bundle:server:all": "node scripts/bundle-server.cjs --all-platforms",

100 "bundle:webapp": "node scripts/bundle-webapp.cjs",

101 "build": "shx rm -rf dist && tsc --noEmit && pkgroll && node scripts/copy-browser-extension.cjs",

102 "test": "pnpm run build && vitest run --project unit",

103 "test:integration": "pnpm run build && vitest run --project integration-empty --project integration-plan-mode --project integration-authenticated",

104 "cli:install": "node scripts/install-local.cjs",

105 "cli:install:isolated": "node scripts/install-isolated.cjs",

106 "prepare:publish": "node scripts/prepare-publish-package.cjs",

107 "guard:publish": "node scripts/guard-publish-artifact.cjs",

108 "prepublishOnly": "node scripts/assert-publish-tool.cjs && node scripts/guard-publish-artifact.cjs . --install-smoke",

109 "postinstall": "node scripts/verify-bundled-deps.cjs && node scripts/unpack-tools.cjs && node scripts/fix-node-pty-perms.cjs && node scripts/install-companion-tools.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L109

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L109

110 },

111 "dependencies": {

112 "@agentclientprotocol/sdk": "^0.14.1",

113 "@anthropic-ai/claude-agent-sdk": "0.3.283",

114 "@anthropic-ai/sandbox-runtime": "0.0.37",

115 "@anthropic-ai/sdk": "0.96.0",

116 "@buzzni/saycode-cli": "0.6.0",

117 "@modelcontextprotocol/sdk": "1.29.0",

118 "@noble/ed25519": "^3.0.0",

119 "@noble/hashes": "^2.0.1",

120 "@paralleldrive/cuid2": "^2.2.2",

121 "@slopus/happy-wire": "0.1.0",

122 "@stablelib/base64": "^2.0.1",

123 "@stablelib/hex": "^2.0.1",

124 "@types/cross-spawn": "^6.0.6",

125 "@types/http-proxy": "^1.17.17",

126 "@types/qrcode-terminal": "^0.12.2",

127 "@types/react": "^19.2.7",

128 "@types/tmp": "^0.2.6",

129 "ai": "^5.0.107",

bin/happy.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

5import { fileURLToPath } from

dist/types-mEOcHkT4.mjsView file

1765stdio: ["ignore", "ignore", "ignore", "ipc"], L1766: execArgv: ["--max-old-space-size=32"] L1767: });

High

Shell

Package source references shell execution.

dist/types-mEOcHkT4.mjsView on unpkg · L1765

scripts/browser-poc/fixture.test.tsView file

Lines 14-45typescript

14async function req(url: string, method = 'GET', body?: unknown, auth = false) {

dist/runGemini-BsHNDAk6.cjsView file

Lines 1-22javascript

1'use strict';

3var ink = require('ink');

4var React = require('react');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runGemini-BsHNDAk6.cjsView on unpkg · L2

dist/managedRuntimeBoot-BCap_XW-.mjsView file

Lines 1-25javascript

1import { writeFileSync, readFileSync, mkdirSync, renameSync, fsyncSync, readdirSync, lstatSync, realpathSync, openSync, fstatSync, readSync, closeSync, writeSync, unlinkSync, constants, opendirSync, createReadStream, fchmodSync, chownSync, chmodSync } from 'node:fs';

2import { join, sep, resolve, posix, dirname, relative } from 'node:path';

3import { v as verifyManagedDispatchMaterial, q as canonicalManagedPayloadDigest, M as MANAGED_PROJECT_ROOT, l as

dist/main-CG_hqbMK.cjsView file

14Detached bundled service listener: dist/main-CG_hqbMK.cjs launches a Node helper and exposes a broad-bound HTTP listener. L14: var ink = require('ink'); L15: var axios = require('axios'); L16: var net = require('node:net'); L17: var React = require('react'); L18: var node_child_process = require('node:child_process'); L19: var egressProxy = require('./egressProxy-B5ejDLBy.cjs'); ... L129: if (!input.proposal || typeof input.proposal !== "object" || Array.isArray(input.proposal) || Buffer.byteLength(JSON.stringify(input.proposal), "utf8") > 16384) return { accepted: ... L130: active.proposal = JSON.parse(JSON.stringify(input.proposal)); L131: return { accepted: true }; ... L451: function getClaudeSettingsPath() { L452: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || path.join(os.ho

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/main-CG_hqbMK.cjsView on unpkg · L14

14Trigger-reachable persistence chain: manifest.main -> dist/index.cjs -> dist/index-DcrLbVY7.cjs -> dist/main-CG_hqbMK.cjs L14: var ink = require('ink'); L15: var axios = require('axios'); L16: var net = require('node:net'); L17: var React = require('react'); L18: var node_child_process = require('node:child_process'); L19: var egressProxy = require('./egressProxy-B5ejDLBy.cjs'); ... L129: if (!input.proposal || typeof input.proposal !== "object" || Array.isArray(input.proposal) || Buffer.byteLength(JSON.stringify(input.proposal), "utf8") > 16384) return { accepted: ... L130: active.proposal = JSON.parse(JSON.stringify(input.proposal)); L131: return { accepted: true }; ... L451: function getClaudeSettingsPath() { L452: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || path.join(os.ho

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/main-CG_hqbMK.cjsView on unpkg · L14

scripts/sandbox-linux-smoke.tsView file

2Source sends the broad process environment to a literal external destination. L2: import assert from 'node:assert/strict'; L3: import { createServer } from 'node:http'; L4: import { spawn, execFileSync } from 'node:child_process'; L5: import { chmodSync, chownSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'; ... L13: L14: assert.equal(process.platform, 'linux'); L15: assert.equal(process.env.HAPPY_SANDBOX_LINUX_SMOKE, '1'); L16: const uid = (name: string) => Number(execFileSync('/usr/bin/id', ['-u', name], { encoding: 'utf8' }).trim()); ... L23: writeFileSync('/etc/aplus/sandbox-policy.json', '{"mode":"mandatory"}'); L24: writeFileSync('/etc/aplus/claude-sandbox.json', JSON.stringify({ allowedDomains: ['api.anthropic.com', 'platform.claude.com', 'private.allowed.t

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

scripts/sandbox-linux-smoke.tsView on unpkg · L2

dist/types-D7QSCORo.cjsView file

•context = ode_fs.existsSync(configuration.daemonStateFile)) {\n return { state: null, raw: null };\n }\n const raw = await fs.readFile(configuration.daemonStateFile, "utf-8");\n return { state: JSON.parse(raw), raw };\n } catch (error) {\n console.error(`[PERSISTENCE] Daemon state file corrupted: ${configuration.daemonStateFile}`, error);\n return { state: null, raw: null };\n }\n}\nasync function readDaemonState() {\n return (await readDaemonStateSnapshot()).state;\n}\nfunction writeDaemonState(state) {\n node_fs.writeFileSync(configuration.daemonStateFile, JSON.stringify(state, null, 2), { encoding: "utf-8", mode: 384 });\n node_fs.chmodSync(configuration.daemonStateFile, 384);\n}\nfunction writeDaemonStateIfUnchanged(expectedRaw, state) {\n const current = node

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/types-D7QSCORo.cjsView on unpkg

2Trigger-reachable chain: manifest.exports -> dist/lib.cjs -> dist/types-D7QSCORo.cjs L2: L3: var axios = require('axios'); L4: var chalk = require('chalk'); ... L16: var fs = require('node:fs/promises'); L17: var node_child_process = require('node:child_process'); L18: var path$1 = require('path'); ... L155: "tools/licenses", L156: "package.json" L157: ]; ... L186: "@slopus/happy-wire": "file:../happy-wire", L187: "@stablelib/base64": "^2.0.1", L188: "@stablelib/hex": "^2.0.1",

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/types-D7QSCORo.cjsView on unpkg · L2

scripts/browser-poc/rollback.mjsView file

•bounded command output exfiltration = ilesync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileurltopath } from 'node:url';\nconst root = dirname(fileurltopath(import.meta.url));\nconst at = process.argv.indexof('--run'); const run = at >= 0 ? process.argv[at+1] : '';\nif (!/^[a-z0-9][a-z0-9-]{0,39}$/.test(run)) throw error('--run is required');\nconst path = join(root,'.abp',run,'env.json');\nconst reportpath = join(root,'.abp',run,'rollback-report.json');\nif (!existssync(path)) { const old = existssync(reportpath) ? json.parse(readfilesync(reportpath)) : { run, alreadydown:true }; console.log(json.stringify(old)); process.exit(0); }\nconst listed = execfilesync('docker', ['ps','-aq','--filter',`label=ai.saycode.abp-run=${run}`], {encoding:'utf8'}).trim();\nif

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

scripts/browser-poc/rollback.mjsView on unpkg

scripts/script-egress-proxy.test.mjsView file

5test('resolves and pins only registered public destinations', async () => { L6: assert.equal(await authorizeDestination('https://example.com', ['https://example.com'], [], async () => ['93.184.216.34']), '93.184.216.34'); L7: await assert.rejects(authorizeDestination('https://other.com', ['https://example.com'], [], async () => ['93.184.216.34']), /ORIGIN_DENIED/); L8: }); L9: test('blocks metadata, loopback, RFC1918, carrier NAT and mixed public/private DNS answers', async () => { L10: for (const address of ['127.0.0.1', '169.254.169.254', '10.0.0.1', '172.16.0.1', '192.168.0.1', '100.64.0.1', '0.0.0.0', '224.0.0.1', '::1']) { ... L16: await assert.rejects(authorizeDestination('http://db:8090', [], ['http://db:8090'], async () => ['172.18.0.2']), /ORIGIN_DENIED/); L17: await assert.re

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

scripts/script-egress-proxy.test.mjsView on unpkg · L5

dist/index-DcrLbVY7.cjsView file

4Cross-file remote execution chain: dist/index-DcrLbVY7.cjs spawns dist/main-CG_hqbMK.cjs; helper contains network access plus dynamic code execution. L4: var z = require('zod'); L5: var node_child_process = require('node:child_process'); L6: var node_fs = require('node:fs'); ... L25: if (raw.length > 1024) throw new Error(); L26: return launchBootstrapSchema.parse(JSON.parse(raw)); L27: } catch { ... L81: execPath: process.execPath, L82: env: process.env, L83: resolveSaycodeManifest: () => node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _document... L84: readManifest: (path) => node_fs.readFileSync(path, "utf8"),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index-DcrLbVY7.cjsView on unpkg · L4

scripts/agent-browser/images/browser-entrypoint.shView file

•path = scripts/agent-browser/images/browser-entrypoint.sh kind = build_helper sizeBytes = 1786 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/agent-browser/images/browser-entrypoint.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/electronGuiPreload.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/electronGuiPreload.cjs#virtual:normalized:round1View on unpkg

dist/browserSessionBrokerContract-CC5vYaGy.cjsView file

•matchType = normalized_sha256 matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = [redacted]-CC5vYaGy.cjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browserSessionBrokerContract-CC5vYaGy.cjsView on unpkg

dist/config-Cb8P9mSq.cjsView file

•matchType = token_shingles matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = dist/config-CFeak50T.cjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-Cb8P9mSq.cjsView on unpkg

dist/AcpBackend-BX1NAPJ1.cjsView file

•matchType = normalized_sha256 matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = dist/AcpBackend-TABtrb6f.cjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/AcpBackend-BX1NAPJ1.cjsView on unpkg

dist/index-BOZgrpd0.cjsView file

•matchType = token_shingles matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = dist/index-DG_VKf2a.cjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index-BOZgrpd0.cjsView on unpkg

node_modules/@buzzni/saycode-cli/index.mjsView file

•matchType = normalized_sha256 matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = node_modules/@buzzni/saycode-cli/index.mjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/@buzzni/saycode-cli/index.mjsView on unpkg

dist/browserSessionBrokerContract-rWpazLfs.mjsView file

•matchType = normalized_sha256 matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = [redacted]-rWpazLfs.mjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browserSessionBrokerContract-rWpazLfs.mjsView on unpkg

dist/config-CYtPv-e2.mjsView file

•matchType = token_shingles matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = dist/config-DxHsq4V2.mjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-CYtPv-e2.mjsView on unpkg

dist/lib.cjsView file

•matchType = normalized_sha256 matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = dist/lib.cjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.cjsView on unpkg

dist/managedMarkerWriter-yG5SBtQ0.cjsView file

•matchType = normalized_sha256 matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = dist/managedMarkerWriter-rkWY_TYc.cjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/managedMarkerWriter-yG5SBtQ0.cjsView on unpkg

dist/runOpenClaw-NieAWETT.cjsView file

•matchType = token_shingles matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = dist/runOpenClaw-C-0Fmk2y.cjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runOpenClaw-NieAWETT.cjsView on unpkg

dist/AcpBackend-rBvsN1VZ.mjsView file

•matchType = normalized_sha256 matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = dist/AcpBackend-Ck0anklG.mjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/AcpBackend-rBvsN1VZ.mjsView on unpkg

dist/browserSessionBrokerMain.mjsView file

•matchType = normalized_sha256 matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = dist/browserSessionBrokerMain.mjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browserSessionBrokerMain.mjsView on unpkg

Source & flagged code

34 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/verify-bundled-deps.cjs && node scripts/unpack-tools.cjs && node scripts/fix-node-pty-perms.cjs && node scripts/install-companion-tools.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/verify-bundled-deps.cjs && node scripts/unpack-tools.cjs && node scripts/fix-node-pty-perms.cjs && node scripts/install-companion-tools.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/happy.mjsView file

2L3: import { execFileSync } from 'child_process'; L4: import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

dist/types-mEOcHkT4.mjsView file

1765stdio: ["ignore", "ignore", "ignore", "ipc"], L1766: execArgv: ["--max-old-space-size=32"] L1767: });

High

Shell

Package source references shell execution.

dist/types-mEOcHkT4.mjsView on unpkg · L1765

scripts/browser-poc/fixture.test.tsView file

34for (const match of body.matchAll(/<script>([\s\S]*?)<\/script>/g)) { L35: expect(() => new Function(match[1]), `${path} script`).not.toThrow() L36: }

High

Eval

Package source references dynamic code evaluation.

scripts/browser-poc/fixture.test.tsView on unpkg · L34

dist/runGemini-BsHNDAk6.cjsView file

2L3: var ink = require('ink'); L4: var React = require('react');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runGemini-BsHNDAk6.cjsView on unpkg · L2

dist/managedRuntimeBoot-BCap_XW-.mjsView file

5import { randomBytes, timingSafeEqual, createHash, createCipheriv, randomUUID } from 'node:crypto'; L6: import { createServer } from 'node:http'; L7: import { spawn, spawnSync, execFile } from 'node:child_process'; L8: import { open, rm, mkdir, lstat, readdir, realpath, opendir, readlink, readFile, stat } from 'node:fs/promises'; ... L51: import './egressProxy-Bpt-0mt5.mjs'; L52: import 'node:dns/promises'; L53: import '@anthropic-ai/claude-agent-sdk'; ... L92: } L93: return { quiesced: true, exitCode: 0, signal: null, providerState }; L94: } ... L300: try { L301: parsed = JSON.parse(raw.toString("utf8"));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/managedRuntimeBoot-BCap_XW-.mjsView on unpkg · L5

dist/main-CG_hqbMK.cjsView file

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/main-CG_hqbMK.cjsView on unpkg · L14

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/main-CG_hqbMK.cjsView on unpkg · L14

14var ink = require('ink'); L15: var axios = require('axios'); L16: var net = require('node:net'); L17: var React = require('react'); L18: var node_child_process = require('node:child_process'); L19: var egressProxy = require('./egressProxy-B5ejDLBy.cjs'); ... L129: if (!input.proposal || typeof input.proposal !== "object" || Array.isArray(input.proposal) || Buffer.byteLength(JSON.stringify(input.proposal), "utf8") > 16384) return { accepted: ... L130: active.proposal = JSON.parse(JSON.stringify(input.proposal)); L131: return { accepted: true }; ... L451: function getClaudeSettingsPath() { L452: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude"); L453: return path.join(claudeConfigDir, "settings.json");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/main-CG_hqbMK.cjsView on unpkg · L14

scripts/sandbox-linux-smoke.tsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

scripts/sandbox-linux-smoke.tsView on unpkg · L2

dist/types-D7QSCORo.cjsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/types-D7QSCORo.cjsView on unpkg

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/types-D7QSCORo.cjsView on unpkg · L2

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/types-D7QSCORo.cjs: var node_readline = require('node:readline'); const SENSITIVE_LOG_KEY = /(^|_)(authorization|token|secret|password|passphrase|api_key|private_key|encryption_key|access_key)($|_)/i; if (typeof meta.difficultyRoutingAuthorization !== "string" || meta.difficultyRoutingAuthorization.length === 0) return false; difficultyRoutingAuthorization: z.z.string().optional(), segments: [".ax", ".claude", ".omc", ".happy", ".codex", ".cursor", ".aider"], rpcHandlerManager.registerHandler("writeFile", async (data) => { await fs$1.writeFile(validation.resolvedPath, buffer); await fs.writeFile(tmpFile, JSON.stringify(updated, nu

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/types-D7QSCORo.cjsView on unpkg

2L3: var axios = require('axios'); L4: var chalk = require('chalk'); ... L16: var fs = require('node:fs/promises'); L17: var node_child_process = require('node:child_process'); L18: var path$1 = require('path'); ... L155: "tools/licenses", L156: "package.json" L157: ]; ... L186: "@slopus/happy-wire": "file:../happy-wire", L187: "@stablelib/base64": "^2.0.1", L188: "@stablelib/hex": "^2.0.1",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/types-D7QSCORo.cjsView on unpkg · L2

scripts/browser-poc/rollback.mjsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

scripts/browser-poc/rollback.mjsView on unpkg

scripts/script-egress-proxy.test.mjsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

scripts/script-egress-proxy.test.mjsView on unpkg · L5

dist/index-DcrLbVY7.cjsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index-DcrLbVY7.cjsView on unpkg · L4

scripts/agent-browser/images/browser-entrypoint.shView file

•path = scripts/agent-browser/images/browser-entrypoint.sh kind = build_helper sizeBytes = 1786 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/agent-browser/images/browser-entrypoint.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/electronGuiPreload.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/electronGuiPreload.cjs#virtual:normalized:round1View on unpkg

dist/browserSessionBrokerContract-CC5vYaGy.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browserSessionBrokerContract-CC5vYaGy.cjsView on unpkg

dist/config-Cb8P9mSq.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-Cb8P9mSq.cjsView on unpkg

dist/AcpBackend-BX1NAPJ1.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/AcpBackend-BX1NAPJ1.cjsView on unpkg

dist/index-BOZgrpd0.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index-BOZgrpd0.cjsView on unpkg

node_modules/@buzzni/saycode-cli/index.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/@buzzni/saycode-cli/index.mjsView on unpkg

dist/browserSessionBrokerContract-rWpazLfs.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browserSessionBrokerContract-rWpazLfs.mjsView on unpkg

dist/config-CYtPv-e2.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-CYtPv-e2.mjsView on unpkg

dist/lib.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.cjsView on unpkg

dist/managedMarkerWriter-yG5SBtQ0.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/managedMarkerWriter-yG5SBtQ0.cjsView on unpkg

dist/runOpenClaw-NieAWETT.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runOpenClaw-NieAWETT.cjsView on unpkg

dist/AcpBackend-rBvsN1VZ.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/AcpBackend-rBvsN1VZ.mjsView on unpkg

dist/browserSessionBrokerMain.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browserSessionBrokerMain.mjsView on unpkg

Findings

4 Critical24 High8 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationscripts/sandbox-linux-smoke.ts

CriticalCommand Output Exfiltrationscripts/browser-poc/rollback.mjs

CriticalEncrypted Payload Temp Executiondist/types-D7QSCORo.cjs

CriticalTrigger Reachable Dangerous Capabilitydist/types-D7QSCORo.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/happy.mjs

HighShelldist/types-mEOcHkT4.mjs

HighEvalscripts/browser-poc/fixture.test.ts

HighCredential Redirect Persistencedist/types-D7QSCORo.cjs

HighSandbox Evasion Gated Capabilitydist/types-D7QSCORo.cjs

HighCloud Metadata Accessscripts/script-egress-proxy.test.mjs

HighCross File Remote Execution Contextdist/index-DcrLbVY7.cjs

HighSpawned Bundled Service Listenerdist/main-CG_hqbMK.cjs

HighTrigger Reachable Persistencedist/main-CG_hqbMK.cjs

HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz

HighSemantic Analysis Limiteddist/electronGuiPreload.cjs#virtual:normalized:round1

HighKnown Malware Source Similaritydist/browserSessionBrokerContract-CC5vYaGy.cjs

HighKnown Malware Source Similaritydist/config-Cb8P9mSq.cjs

HighKnown Malware Source Similaritydist/AcpBackend-BX1NAPJ1.cjs

HighKnown Malware Source Similaritydist/index-BOZgrpd0.cjs

HighKnown Malware Source Similaritynode_modules/@buzzni/saycode-cli/index.mjs

HighKnown Malware Source Similaritydist/browserSessionBrokerContract-rWpazLfs.mjs

HighKnown Malware Source Similaritydist/config-CYtPv-e2.mjs

HighKnown Malware Source Similaritydist/lib.cjs

HighKnown Malware Source Similaritydist/managedMarkerWriter-yG5SBtQ0.cjs

HighKnown Malware Source Similaritydist/runOpenClaw-NieAWETT.cjs

HighKnown Malware Source Similaritydist/AcpBackend-rBvsN1VZ.mjs

HighKnown Malware Source Similaritydist/browserSessionBrokerMain.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/runGemini-BsHNDAk6.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/main-CG_hqbMK.cjs

MediumShips Build Helperscripts/agent-browser/images/browser-entrypoint.sh

MediumShips Compressed Blobtools/archives/difftastic-arm64-linux.tar.gz

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/managedRuntimeBoot-BCap_XW-.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @buzzni/happy-cli@1.1.10-aplus.253.

See version security history for other recorded verdicts.

Review the evidence and your use of @buzzni/happy-cli@1.1.10-aplus.253 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 02:31:51.536Z (UTC).

89%Suspicious

AI assessment confidence

IntentDangerous Capability

TypeInstall Hook Abuse

False-positive riskMedium

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

AuthorKirill Dubovitskiy

Maintainersnamsangboy

Version1.1.10-aplus.253

Latest on npm1.1.10-aplus.303

PublishedSep 28, 2026

LicenseMIT

Dependencies42

Integrityverified

Package size103 MB

Files1,275

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.cjsmodule → ./dist/index.mjstypes → ./dist/index.d.ctsexports mapbin → happy, happy-browser-session-broker, happy-mcp

RuntimeNo engine / OS / CPU constraints

Artifact121 MB · 1,275 files2 signature(s) · provenance

Install lifecyclepostinstallprepublishOnly

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocketHighEntropyStringsUrlStringsManifest: clean