registry / @buzzni/happy-cli / 1.1.10-aplus.59

@buzzni/happy-cli@1.1.10-aplus.59

A+ Dev Studio fork of slopus/happy. Mobile and Web client for Claude Code and Codex.

Static Scan Results

scanned 26d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 40 file(s), 2.02 MB of source, external domains: 127.0.0.1, accounts.google.com, api.anthropic.com, api.cluster-fluster.com, api.deepseek.com, api.openai.com, app.happy.engineering, auth.openai.com, claude.ai, console.anthropic.com, developers.google.com, github.com, goo.gle, happy.engineering, oauth2.googleapis.com, registry.npmjs.org, www.googleapis.com

Source & flagged code

10 flagged

package.jsonView file

Lines 60-100json

60 "bin",

61 "scripts",

62 "tools/archives",

63 "tools/licenses",

64 "package.json"

65 ],

66 "scripts": {

67 "cli": "tsx src/index.ts",

68 "dev": "tsx src/index.ts",

69 "typecheck": "tsc --noEmit",

70 "bundle:server": "node scripts/bundle-server.cjs",

71 "bundle:server:all": "node scripts/bundle-server.cjs --all-platforms",

72 "bundle:webapp": "node scripts/bundle-webapp.cjs",

73 "build": "shx rm -rf dist && tsc --noEmit && pkgroll",

74 "test": "pnpm run build && vitest run --project unit",

75 "test:integration": "pnpm run build && vitest run --project integration-empty --project integration-plan-mode --project integration-authenticated",

76 "cli:install": "node scripts/install-local.cjs",

77 "prepare:publish": "node scripts/prepare-publish-package.cjs",

78 "guard:publish": "node scripts/guard-publish-artifact.cjs",

79 "prepublishOnly": "node scripts/assert-publish-tool.cjs && node scripts/guard-publish-artifact.cjs . --install-smoke",

80 "postinstall": "node scripts/verify-bundled-deps.cjs && node scripts/unpack-tools.cjs && node scripts/fix-node-pty-perms.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L80

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L80

81 },

82 "dependencies": {

83 "@agentclientprotocol/sdk": "^0.14.1",

84 "@anthropic-ai/claude-agent-sdk": "^0.3.179",

85 "@anthropic-ai/sandbox-runtime": "^0.0.37",

86 "@anthropic-ai/sdk": "0.96.0",

87 "@modelcontextprotocol/sdk": "1.29.0",

88 "@noble/ed25519": "^3.0.0",

89 "@noble/hashes": "^2.0.1",

90 "@paralleldrive/cuid2": "^2.2.2",

91 "@slopus/happy-wire": "0.1.0",

92 "@stablelib/base64": "^2.0.1",

93 "@stablelib/hex": "^2.0.1",

94 "@types/cross-spawn": "^6.0.6",

95 "@types/http-proxy": "^1.17.17",

96 "@types/qrcode-terminal": "^0.12.2",

97 "@types/react": "^19.2.7",

98 "@types/tmp": "^0.2.6",

99 "ai": "^5.0.107",

100 "axios": "^1.13.2",

bin/happy.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

5import { fileURLToPath } from

dist/index-DoNl4v20.mjsView file

Lines 1-23javascript

1import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import chalk from 'chalk';

2import os$1, { homedir, tmpdir } from

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

Source & flagged code

10 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code