Loading npm security reports…

@buzzni/happy-cli@1.1.10-aplus.260: AI-agent control-surface risk | LPM Firewall

registry / @buzzni/happy-cli / 1.1.10-aplus.260

@buzzni/happy-cli@1.1.10-aplus.260

A+ Dev Studio fork of slopus/happy. Mobile and Web client for Claude Code and Codex.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An npm post-install hook automatically adds external AI authentication and agent tools to the user's global tool environment. This mutates a broad AI-agent control surface without an interactive consent step.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing this package globally outside CI without the opt-out environment variable.

Impact

The install can introduce externally supplied agent and authentication tooling onto the user's PATH and into their global package environment.

Mechanism

The lifecycle hook invokes the companion installer, which calls npm and uv to install global companion tools.

Policy narrative

A global installation automatically runs a lifecycle hook that installs a third-party Codex multi-authentication utility and a Claude-related utility. The package also contains runtime logic that installs the Codex tool globally when it is missing. These actions alter the user's global AI-agent tooling without a separate consent prompt, creating an unconsented agent control-surface change.

AI rationale

The automatic post-installation of external AI authentication tooling into the global environment is a concrete unconsented lifecycle mutation. The environment gates limit scope but do not remove the behavior for ordinary global installs.

Evidence

package.jsonscripts/install-companion-tools.cjsdist/main-CBLOa68U.cjs

Decision evidence

Source & flagged code

36 flagged

package.jsonView file

Lines 89-129json

89 "tools/archives",

90 "tools/licenses",

91 "package.json"

92 ],

93 "scripts": {

94 "cli": "tsx src/index.ts",

95 "dev": "tsx src/index.ts",

96 "typecheck": "tsc --noEmit",

97 "test:browser-poc": "vitest run --project browser-poc",

98 "bundle:server": "node scripts/bundle-server.cjs",

99 "bundle:server:all": "node scripts/bundle-server.cjs --all-platforms",

100 "bundle:webapp": "node scripts/bundle-webapp.cjs",

101 "build": "shx rm -rf dist && tsc --noEmit && pkgroll && node scripts/copy-browser-extension.cjs",

102 "test": "pnpm run build && vitest run --project unit",

103 "test:integration": "pnpm run build && vitest run --project integration-empty --project integration-plan-mode --project integration-authenticated",

104 "cli:install": "node scripts/install-local.cjs",

105 "cli:install:isolated": "node scripts/install-isolated.cjs",

106 "prepare:publish": "node scripts/prepare-publish-package.cjs",

107 "guard:publish": "node scripts/guard-publish-artifact.cjs",

108 "prepublishOnly": "node scripts/assert-publish-tool.cjs && node scripts/guard-publish-artifact.cjs . --install-smoke",

109 "postinstall": "node scripts/verify-bundled-deps.cjs && node scripts/unpack-tools.cjs && node scripts/fix-node-pty-perms.cjs && node scripts/install-companion-tools.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L109

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L109

110 },

111 "dependencies": {

112 "@agentclientprotocol/sdk": "^0.14.1",

113 "@anthropic-ai/claude-agent-sdk": "0.3.283",

114 "@anthropic-ai/sandbox-runtime": "0.0.37",

115 "@anthropic-ai/sdk": "0.96.0",

116 "@buzzni/saycode-cli": "0.7.1",

117 "@modelcontextprotocol/sdk": "1.29.0",

118 "@noble/ed25519": "^3.0.0",

119 "@noble/hashes": "^2.0.1",

120 "@paralleldrive/cuid2": "^2.2.2",

121 "@slopus/happy-wire": "0.1.0",

122 "@stablelib/base64": "^2.0.1",

123 "@stablelib/hex": "^2.0.1",

124 "@types/cross-spawn": "^6.0.6",

125 "@types/http-proxy": "^1.17.17",

126 "@types/qrcode-terminal": "^0.12.2",

127 "@types/react": "^19.2.7",

128 "@types/tmp": "^0.2.6",

129 "ai": "^5.0.107",

bin/happy.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

5import { fileURLToPath } from

dist/types-Duqx2lo3.cjsView file

•context = ode_fs.existsSync(configuration.daemonStateFile)) {\n return { state: null, raw: null };\n }\n const raw = await fs.readFile(configuration.daemonStateFile, "utf-8");\n return { state: JSON.parse(raw), raw };\n } catch (error) {\n console.error(`[PERSISTENCE] Daemon state file corrupted: ${configuration.daemonStateFile}`, error);\n return { state: null, raw: null };\n }\n}\nasync function readDaemonState() {\n return (await readDaemonStateSnapshot()).state;\n}\nfunction writeDaemonState(state) {\n node_fs.writeFileSync(configuration.daemonStateFile, JSON.stringify(state, null, 2), { encoding: "utf-8", mode: 384 });\n node_fs.chmodSync(configuration.daemonStateFile, 384);\n}\nfunction writeDaemonStateIfUnchanged(expectedRaw, state) {\n const current = node

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/types-Duqx2lo3.cjsView on unpkg

2Trigger-reachable chain: manifest.exports -> dist/lib.cjs -> dist/types-Duqx2lo3.cjs L2: L3: var axios = require('axios'); L4: var chalk = require('chalk'); ... L16: var fs = require('node:fs/promises'); L17: var node_child_process = require('node:child_process'); L18: var path$1 = require('path'); ... L155: "tools/licenses", L156: "package.json" L157: ]; ... L186: "@slopus/happy-wire": "file:../happy-wire", L187: "@stablelib/base64": "^2.0.1", L188: "@stablelib/hex": "^2.0.1",

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/types-Duqx2lo3.cjsView on unpkg · L2

scripts/browser-poc/fixture.test.tsView file

Lines 14-45typescript

14async function req(url: string, method = 'GET', body?: unknown, auth = false) {

dist/browserBridgeConfig-CaTlK-SZ.cjsView file

Lines 1-22javascript

1'use strict';

3var crypto = require('node:crypto');

4var fs = require('node:fs/promises');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/browserBridgeConfig-CaTlK-SZ.cjsView on unpkg · L2

node_modules/@buzzni/saycode-cli/index.mjsView file

7import require$$1 from "url"; L8: import require$$2 from "child_process"; L9: import require$$3 from "http"; L10: import require$$4 from "https"; ... L625: "agentBoard.verify.phase.start": "구동 확인", L626: "agentBoard.verify.detail.noRecipe": "실행할 레시피가 없습니다. package.json 스크립트, Makefile, 또는 .aplus/verify.json이 필요합니다.", L627: "agentBoard.verify.detail.phaseFailed": "{phase} 실패 · {reason}", ... L4639: "planDevelopment.prompt": "위 계획을 승인합니다. 계획과 작업 목록의 순서대로 개발을 진행하세요. 구현 후 관련 테스트, 타입 검사, 빌드를 실행해 정상 동작을 검증하고, 실패하면 원인을 수정한 뒤 다시 검증하세요. 승인된 계획 밖의 범위 확장이 필요할 때만 다시 확인하고, 완료 후 변경 사항과 검증... L4640: "pushFailureRecovery.prompt.auth": "{branch} 브랜치로 git push가 인증 오류로 실패했습니다. 원격 저장소 인증(자격 증명/토큰/SSH 키)을 확인하고 문제를 해결해주세요.\n\n에러 내용:\n{stderr}", L4641: "pushFailureRecovery.prompt.non-fast-forward": "{branch}

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

node_modules/@buzzni/saycode-cli/index.mjsView on unpkg · L7

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

scripts/agent-browser/abpInstall.test.tsView file

Lines 1-21typescript

1import { spawnSync } from 'node:child_process'

2import { generateKeyPairSync } from 'node:crypto'

3import { chmodSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, renameSync, rmSync, symlinkSync, utimesSync, writeFileSync } from 'node:fs'

4import { homedir, tmpdir, userInfo } from 'node:os'

scripts/sandbox-linux-smoke.tsView file

2Source sends the broad process environment to a literal external destination. L2: import assert from 'node:assert/strict'; L3: import { createServer } from 'node:http'; L4: import { spawn, execFileSync } from 'node:child_process'; L5: import { chmodSync, chownSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'; ... L13: L14: assert.equal(process.platform, 'linux'); L15: assert.equal(process.env.HAPPY_SANDBOX_LINUX_SMOKE, '1'); L16: const uid = (name: string) => Number(execFileSync('/usr/bin/id', ['-u', name], { encoding: 'utf8' }).trim()); ... L23: writeFileSync('/etc/aplus/sandbox-policy.json', '{"mode":"mandatory"}'); L24: writeFileSync('/etc/aplus/claude-sandbox.json', JSON.stringify({ allowedDomains: ['api.anthropic.com', 'platform.claude.com', 'private.allowed.t

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

scripts/sandbox-linux-smoke.tsView on unpkg · L2

scripts/browser-poc/rollback.mjsView file

•bounded command output exfiltration = ilesync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileurltopath } from 'node:url';\nconst root = dirname(fileurltopath(import.meta.url));\nconst at = process.argv.indexof('--run'); const run = at >= 0 ? process.argv[at+1] : '';\nif (!/^[a-z0-9][a-z0-9-]{0,39}$/.test(run)) throw error('--run is required');\nconst path = join(root,'.abp',run,'env.json');\nconst reportpath = join(root,'.abp',run,'rollback-report.json');\nif (!existssync(path)) { const old = existssync(reportpath) ? json.parse(readfilesync(reportpath)) : { run, alreadydown:true }; console.log(json.stringify(old)); process.exit(0); }\nconst listed = execfilesync('docker', ['ps','-aq','--filter',`label=ai.saycode.abp-run=${run}`], {encoding:'utf8'}).trim();\nif

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

scripts/browser-poc/rollback.mjsView on unpkg

scripts/script-egress-proxy.test.mjsView file

5test('resolves and pins only registered public destinations', async () => { L6: assert.equal(await authorizeDestination('https://example.com', ['https://example.com'], [], async () => ['93.184.216.34']), '93.184.216.34'); L7: await assert.rejects(authorizeDestination('https://other.com', ['https://example.com'], [], async () => ['93.184.216.34']), /ORIGIN_DENIED/); L8: }); L9: test('blocks metadata, loopback, RFC1918, carrier NAT and mixed public/private DNS answers', async () => { L10: for (const address of ['127.0.0.1', '169.254.169.254', '10.0.0.1', '172.16.0.1', '192.168.0.1', '100.64.0.1', '0.0.0.0', '224.0.0.1', '::1']) { ... L16: await assert.rejects(authorizeDestination('http://db:8090', [], ['http://db:8090'], async () => ['172.18.0.2']), /ORIGIN_DENIED/); L17: await assert.re

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

scripts/script-egress-proxy.test.mjsView on unpkg · L5

dist/index-BH4RWpJ6.cjsView file

4Cross-file remote execution chain: dist/index-BH4RWpJ6.cjs spawns dist/main-CBLOa68U.cjs; helper contains network access plus dynamic code execution. L4: var z = require('zod'); L5: var node_child_process = require('node:child_process'); L6: var node_fs = require('node:fs'); ... L25: if (raw.length > 1024) throw new Error(); L26: return launchBootstrapSchema.parse(JSON.parse(raw)); L27: } catch { ... L87: execPath: process.execPath, L88: env: process.env, L89: resolveSaycodeManifest: () => node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _document... L90: readManifest: (path) => node_fs.readFileSync(path, "utf8"),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index-BH4RWpJ6.cjsView on unpkg · L4

dist/main-CBLOa68U.cjsView file

15Detached bundled service listener: dist/main-CBLOa68U.cjs launches a Node helper and exposes a broad-bound HTTP listener. L15: var ink = require('ink'); L16: var axios = require('axios'); L17: var net = require('node:net'); L18: var React = require('react'); L19: var node_child_process = require('node:child_process'); L20: var egressProxy = require('./egressProxy-B5ejDLBy.cjs'); ... L129: if (!input.proposal || typeof input.proposal !== "object" || Array.isArray(input.proposal) || Buffer.byteLength(JSON.stringify(input.proposal), "utf8") > 16384) return { accepted: ... L130: active.proposal = JSON.parse(JSON.stringify(input.proposal)); L131: return { accepted: true }; ... L454: function getClaudeSettingsPath() { L455: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || path.join(os.ho

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/main-CBLOa68U.cjsView on unpkg · L15

15Trigger-reachable persistence chain: manifest.main -> dist/index.cjs -> dist/index-BH4RWpJ6.cjs -> dist/main-CBLOa68U.cjs L15: var ink = require('ink'); L16: var axios = require('axios'); L17: var net = require('node:net'); L18: var React = require('react'); L19: var node_child_process = require('node:child_process'); L20: var egressProxy = require('./egressProxy-B5ejDLBy.cjs'); ... L129: if (!input.proposal || typeof input.proposal !== "object" || Array.isArray(input.proposal) || Buffer.byteLength(JSON.stringify(input.proposal), "utf8") > 16384) return { accepted: ... L130: active.proposal = JSON.parse(JSON.stringify(input.proposal)); L131: return { accepted: true }; ... L454: function getClaudeSettingsPath() { L455: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || path.join(os.ho

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/main-CBLOa68U.cjsView on unpkg · L15

scripts/agent-browser/images/browser-entrypoint.shView file

•path = scripts/agent-browser/images/browser-entrypoint.sh kind = build_helper sizeBytes = 1786 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/agent-browser/images/browser-entrypoint.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/electronGuiPreload.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/electronGuiPreload.cjs#virtual:normalized:round1View on unpkg

dist/browserSessionBrokerContract-CC5vYaGy.cjsView file

•matchType = normalized_sha256 matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = [redacted]-CC5vYaGy.cjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browserSessionBrokerContract-CC5vYaGy.cjsView on unpkg

dist/config-CLHijNM1.cjsView file

•matchType = token_shingles matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = dist/config-CFeak50T.cjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-CLHijNM1.cjsView on unpkg

dist/browserSessionBrokerContract-rWpazLfs.mjsView file

•matchType = normalized_sha256 matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = [redacted]-rWpazLfs.mjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browserSessionBrokerContract-rWpazLfs.mjsView on unpkg

dist/config-DQLTECvu.mjsView file

•matchType = token_shingles matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = dist/config-DxHsq4V2.mjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-DQLTECvu.mjsView on unpkg

dist/lib.cjsView file

•matchType = normalized_sha256 matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = dist/lib.cjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.cjsView on unpkg

dist/managedMarkerWriter-BV0bO8Lq.cjsView file

•matchType = normalized_sha256 matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = dist/managedMarkerWriter-rkWY_TYc.cjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/managedMarkerWriter-BV0bO8Lq.cjsView on unpkg

dist/runOpenClaw-bYwYwY1n.cjsView file

•matchType = token_shingles matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = dist/runOpenClaw-C-0Fmk2y.cjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runOpenClaw-bYwYwY1n.cjsView on unpkg

dist/browserSessionBrokerMain.mjsView file

•matchType = normalized_sha256 matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = dist/browserSessionBrokerMain.mjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browserSessionBrokerMain.mjsView on unpkg

dist/difficultyRoutingArtifacts-Dd5ZRcr2.cjsView file

•matchType = normalized_sha256 matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = dist/difficultyRoutingArtifacts-Dd5ZRcr2.cjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/difficultyRoutingArtifacts-Dd5ZRcr2.cjsView on unpkg

dist/egressProxy-B5ejDLBy.cjsView file

•matchType = normalized_sha256 matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = dist/egressProxy-B5ejDLBy.cjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/egressProxy-B5ejDLBy.cjsView on unpkg

dist/lib.mjsView file

•matchType = normalized_sha256 matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = dist/lib.mjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.mjsView on unpkg

dist/managedMarkerWriter-DpTwoJ-d.mjsView file

•matchType = normalized_sha256 matchedPackage = @buzzni/happy-cli@1.1.10-aplus.248 matchedPath = dist/managedMarkerWriter-7BZ_cPHP.mjs matchedIdentity = npm:QGJ1enpuaS9oYXBweS1jbGk:1.1.10-aplus.248 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/managedMarkerWriter-DpTwoJ-d.mjsView on unpkg

Source & flagged code

36 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/verify-bundled-deps.cjs && node scripts/unpack-tools.cjs && node scripts/fix-node-pty-perms.cjs && node scripts/install-companion-tools.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/verify-bundled-deps.cjs && node scripts/unpack-tools.cjs && node scripts/fix-node-pty-perms.cjs && node scripts/install-companion-tools.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/happy.mjsView file

2L3: import { execFileSync } from 'child_process'; L4: import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

dist/types-Duqx2lo3.cjsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/types-Duqx2lo3.cjsView on unpkg

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/types-Duqx2lo3.cjsView on unpkg · L2

scripts/browser-poc/fixture.test.tsView file

34for (const match of body.matchAll(/<script>([\s\S]*?)<\/script>/g)) { L35: expect(() => new Function(match[1]), `${path} script`).not.toThrow() L36: }

High

Eval

Package source references dynamic code evaluation.

scripts/browser-poc/fixture.test.tsView on unpkg · L34

dist/browserBridgeConfig-CaTlK-SZ.cjsView file

2L3: var crypto = require('node:crypto'); L4: var fs = require('node:fs/promises');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/browserBridgeConfig-CaTlK-SZ.cjsView on unpkg · L2

node_modules/@buzzni/saycode-cli/index.mjsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

node_modules/@buzzni/saycode-cli/index.mjsView on unpkg · L7

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

scripts/agent-browser/abpInstall.test.tsView file

1import { spawnSync } from 'node:child_process' L2: import { generateKeyPairSync } from 'node:crypto' ... L20: writeFileSync(pemFile, generateKeyPairSync('ed25519').publicKey.export({ type: 'spki', format: 'pem' }).toString()) L21: writeFileSync(sitesFile, JSON.stringify([{ origin: 'https://shop.example' }])) L22: }) ... L26: encoding: 'utf8', L27: env: { PATH: process.env.PATH, HOME: dir, ABP_NODE: process.execPath, ABP_DRY_RUN_SECRET: SECRET_SENTINEL }, L28: }) ... L43: planMain(['install-options', '--saved', join(dir, 'missing.json'), '--workspace-id', 'w', '--profile', 'main=u', '--issuer', `k=${pemFile}`], (text: string) => { out += text }) L44: expect(JSON.parse(out).machineId).toBe('auto') L45: const saved = join(dir, 'install.json') ... L61: mkdirSync(join(root, 'dist', 'sandbox

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/agent-browser/abpInstall.test.tsView on unpkg · L1

scripts/sandbox-linux-smoke.tsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

scripts/sandbox-linux-smoke.tsView on unpkg · L2

scripts/browser-poc/rollback.mjsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

scripts/browser-poc/rollback.mjsView on unpkg

scripts/script-egress-proxy.test.mjsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

scripts/script-egress-proxy.test.mjsView on unpkg · L5

dist/index-BH4RWpJ6.cjsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index-BH4RWpJ6.cjsView on unpkg · L4

dist/main-CBLOa68U.cjsView file

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/main-CBLOa68U.cjsView on unpkg · L15

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/main-CBLOa68U.cjsView on unpkg · L15

scripts/agent-browser/images/browser-entrypoint.shView file

•path = scripts/agent-browser/images/browser-entrypoint.sh kind = build_helper sizeBytes = 1786 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/agent-browser/images/browser-entrypoint.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/electronGuiPreload.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/electronGuiPreload.cjs#virtual:normalized:round1View on unpkg

dist/browserSessionBrokerContract-CC5vYaGy.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browserSessionBrokerContract-CC5vYaGy.cjsView on unpkg

dist/config-CLHijNM1.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-CLHijNM1.cjsView on unpkg

dist/browserSessionBrokerContract-rWpazLfs.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browserSessionBrokerContract-rWpazLfs.mjsView on unpkg

dist/config-DQLTECvu.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-DQLTECvu.mjsView on unpkg

dist/lib.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.cjsView on unpkg

dist/managedMarkerWriter-BV0bO8Lq.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/managedMarkerWriter-BV0bO8Lq.cjsView on unpkg

dist/runOpenClaw-bYwYwY1n.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runOpenClaw-bYwYwY1n.cjsView on unpkg

dist/browserSessionBrokerMain.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browserSessionBrokerMain.mjsView on unpkg

dist/difficultyRoutingArtifacts-Dd5ZRcr2.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/difficultyRoutingArtifacts-Dd5ZRcr2.cjsView on unpkg

dist/egressProxy-B5ejDLBy.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/egressProxy-B5ejDLBy.cjsView on unpkg

dist/lib.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.mjsView on unpkg

dist/managedMarkerWriter-DpTwoJ-d.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/managedMarkerWriter-DpTwoJ-d.mjsView on unpkg

Findings

6 Critical24 High8 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationscripts/sandbox-linux-smoke.ts

CriticalCredential Exfiltrationnode_modules/@buzzni/saycode-cli/index.mjs

CriticalCommand Output Exfiltrationscripts/browser-poc/rollback.mjs

CriticalEncrypted Payload Temp Executiondist/types-Duqx2lo3.cjs

CriticalRemote Response Code Executionnode_modules/@buzzni/saycode-cli/index.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/types-Duqx2lo3.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/happy.mjs

HighShelldist/types-Duqx2lo3.cjs

HighEvalscripts/browser-poc/fixture.test.ts

HighCredential Redirect Persistencedist/types-Duqx2lo3.cjs

HighSandbox Evasion Gated Capabilitydist/types-Duqx2lo3.cjs

HighCloud Metadata Accessscripts/script-egress-proxy.test.mjs

HighCross File Remote Execution Contextdist/index-BH4RWpJ6.cjs

HighSpawned Bundled Service Listenerdist/main-CBLOa68U.cjs

HighTrigger Reachable Persistencedist/main-CBLOa68U.cjs

HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz

HighSemantic Analysis Limiteddist/electronGuiPreload.cjs#virtual:normalized:round1

HighKnown Malware Source Similaritydist/browserSessionBrokerContract-CC5vYaGy.cjs

HighKnown Malware Source Similaritydist/config-CLHijNM1.cjs

HighKnown Malware Source Similaritydist/browserSessionBrokerContract-rWpazLfs.mjs

HighKnown Malware Source Similaritydist/config-DQLTECvu.mjs

HighKnown Malware Source Similaritydist/lib.cjs

HighKnown Malware Source Similaritydist/managedMarkerWriter-BV0bO8Lq.cjs

HighKnown Malware Source Similaritydist/runOpenClaw-bYwYwY1n.cjs

HighKnown Malware Source Similaritydist/browserSessionBrokerMain.mjs

HighKnown Malware Source Similaritydist/difficultyRoutingArtifacts-Dd5ZRcr2.cjs

HighKnown Malware Source Similaritydist/egressProxy-B5ejDLBy.cjs

HighKnown Malware Source Similaritydist/lib.mjs

HighKnown Malware Source Similaritydist/managedMarkerWriter-DpTwoJ-d.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/browserBridgeConfig-CaTlK-SZ.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencescripts/agent-browser/abpInstall.test.ts

MediumShips Build Helperscripts/agent-browser/images/browser-entrypoint.sh

MediumShips Compressed Blobtools/archives/difftastic-arm64-linux.tar.gz

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptonode_modules/@buzzni/saycode-cli/index.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

36 flagged

package.jsonView file

Lines 89-129json

89 "tools/archives",

90 "tools/licenses",

91 "package.json"

92 ],

93 "scripts": {

94 "cli": "tsx src/index.ts",

95 "dev": "tsx src/index.ts",

96 "typecheck": "tsc --noEmit",

97 "test:browser-poc": "vitest run --project browser-poc",

98 "bundle:server": "node scripts/bundle-server.cjs",

99 "bundle:server:all": "node scripts/bundle-server.cjs --all-platforms",

100 "bundle:webapp": "node scripts/bundle-webapp.cjs",

101 "build": "shx rm -rf dist && tsc --noEmit && pkgroll && node scripts/copy-browser-extension.cjs",

102 "test": "pnpm run build && vitest run --project unit",

103 "test:integration": "pnpm run build && vitest run --project integration-empty --project integration-plan-mode --project integration-authenticated",

104 "cli:install": "node scripts/install-local.cjs",

105 "cli:install:isolated": "node scripts/install-isolated.cjs",

106 "prepare:publish": "node scripts/prepare-publish-package.cjs",

107 "guard:publish": "node scripts/guard-publish-artifact.cjs",

108 "prepublishOnly": "node scripts/assert-publish-tool.cjs && node scripts/guard-publish-artifact.cjs . --install-smoke",

109 "postinstall": "node scripts/verify-bundled-deps.cjs && node scripts/unpack-tools.cjs && node scripts/fix-node-pty-perms.cjs && node scripts/install-companion-tools.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L109

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L109

110 },

111 "dependencies": {

112 "@agentclientprotocol/sdk": "^0.14.1",

113 "@anthropic-ai/claude-agent-sdk": "0.3.283",

114 "@anthropic-ai/sandbox-runtime": "0.0.37",

115 "@anthropic-ai/sdk": "0.96.0",

116 "@buzzni/saycode-cli": "0.7.1",

117 "@modelcontextprotocol/sdk": "1.29.0",

118 "@noble/ed25519": "^3.0.0",

119 "@noble/hashes": "^2.0.1",

120 "@paralleldrive/cuid2": "^2.2.2",

121 "@slopus/happy-wire": "0.1.0",

122 "@stablelib/base64": "^2.0.1",

123 "@stablelib/hex": "^2.0.1",

124 "@types/cross-spawn": "^6.0.6",

125 "@types/http-proxy": "^1.17.17",

126 "@types/qrcode-terminal": "^0.12.2",

127 "@types/react": "^19.2.7",

128 "@types/tmp": "^0.2.6",

129 "ai": "^5.0.107",

bin/happy.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

5import { fileURLToPath } from

dist/types-Duqx2lo3.cjsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/types-Duqx2lo3.cjsView on unpkg

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/types-Duqx2lo3.cjsView on unpkg · L2

scripts/browser-poc/fixture.test.tsView file

Lines 14-45typescript

14async function req(url: string, method = 'GET', body?: unknown, auth = false) {

dist/browserBridgeConfig-CaTlK-SZ.cjsView file

Lines 1-22javascript

1'use strict';

3var crypto = require('node:crypto');

4var fs = require('node:fs/promises');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/browserBridgeConfig-CaTlK-SZ.cjsView on unpkg · L2

node_modules/@buzzni/saycode-cli/index.mjsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

node_modules/@buzzni/saycode-cli/index.mjsView on unpkg · L7

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

scripts/agent-browser/abpInstall.test.tsView file

Lines 1-21typescript

1import { spawnSync } from 'node:child_process'

2import { generateKeyPairSync } from 'node:crypto'

3import { chmodSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, renameSync, rmSync, symlinkSync, utimesSync, writeFileSync } from 'node:fs'

4import { homedir, tmpdir, userInfo } from 'node:os'

scripts/sandbox-linux-smoke.tsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

scripts/sandbox-linux-smoke.tsView on unpkg · L2

scripts/browser-poc/rollback.mjsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

scripts/browser-poc/rollback.mjsView on unpkg

scripts/script-egress-proxy.test.mjsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

scripts/script-egress-proxy.test.mjsView on unpkg · L5

dist/index-BH4RWpJ6.cjsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index-BH4RWpJ6.cjsView on unpkg · L4

dist/main-CBLOa68U.cjsView file

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/main-CBLOa68U.cjsView on unpkg · L15

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/main-CBLOa68U.cjsView on unpkg · L15

scripts/agent-browser/images/browser-entrypoint.shView file

•path = scripts/agent-browser/images/browser-entrypoint.sh kind = build_helper sizeBytes = 1786 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/agent-browser/images/browser-entrypoint.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/electronGuiPreload.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/electronGuiPreload.cjs#virtual:normalized:round1View on unpkg

dist/browserSessionBrokerContract-CC5vYaGy.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browserSessionBrokerContract-CC5vYaGy.cjsView on unpkg

dist/config-CLHijNM1.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-CLHijNM1.cjsView on unpkg

dist/browserSessionBrokerContract-rWpazLfs.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browserSessionBrokerContract-rWpazLfs.mjsView on unpkg

dist/config-DQLTECvu.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-DQLTECvu.mjsView on unpkg

dist/lib.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.cjsView on unpkg

dist/managedMarkerWriter-BV0bO8Lq.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/managedMarkerWriter-BV0bO8Lq.cjsView on unpkg

dist/runOpenClaw-bYwYwY1n.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runOpenClaw-bYwYwY1n.cjsView on unpkg

dist/browserSessionBrokerMain.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/browserSessionBrokerMain.mjsView on unpkg

dist/difficultyRoutingArtifacts-Dd5ZRcr2.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/difficultyRoutingArtifacts-Dd5ZRcr2.cjsView on unpkg

dist/egressProxy-B5ejDLBy.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/egressProxy-B5ejDLBy.cjsView on unpkg

dist/lib.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.mjsView on unpkg

dist/managedMarkerWriter-DpTwoJ-d.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/managedMarkerWriter-DpTwoJ-d.mjsView on unpkg

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code