Static Scan Results
scanned 11d ago · by rust-scannerStatic analysis flagged 21 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
13 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/unpack-tools.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/happy-dev.mjsView file
2L3: import { execFileSync } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
8// Check if we're already running with the flags
L9: const hasNoWarnings = process.execArgv.includes('--no-warnings');
L10: const hasNoDeprecation = process.execArgv.includes('--no-deprecation');
High
dist/runGemini-C43sMCBh.cjsView file
2L3: var ink = require('ink');
L4: var React = require('react');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/runGemini-C43sMCBh.cjsView on unpkg · L2dist/index-BEbnUT5r.mjsView file
27754L27755: const execAsync$1 = promisify$1(exec$1);
L27756: const CLIENT_ID = "681255809395-[redacted].apps.googleusercontent.com";
L27757: const CLIENT_SECRET = process.env.GOOGLE_OAUTH_CLIENT_SECRET ?? "";
L27758: const AUTHORIZE_URL = "https://accounts.google.com/o/oauth2/v2/auth";
L27759: const TOKEN_URL = "https://oauth2.googleapis.com/token";
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index-BEbnUT5r.mjsView on unpkg · L277546import { l as logger, b as projectPath, d as delay, R as RawJSONLinesSchema, I as InvalidateSync, j as createReplayBuffer, c as configuration, k as AsyncLock, m as generateRepoMap,...
L7: import { spawn, exec, execSync, execFile as execFile$1, execFileSync as execFileSync$1 } from 'node:child_process';
L8: import { createInterface } from 'node:readline';
...
L401: }
L402: const sessionData = readFileSync(sessionFile, "utf-8").split("\n");
L403: const hasGoodMessage = !!sessionData.find((v, index) => {
...
L3353: const attachedTerminals = /* @__PURE__ */ new Map();
L3354: let reconnectBaseUrl = null;
L3355: let reconnectInflight = null;
High
Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/index-BEbnUT5r.mjsView on unpkg · L65Cross-file remote execution chain: dist/index-BEbnUT5r.mjs spawns dist/runCodex-THe4hYfp.mjs; helper contains network access plus dynamic code execution.
L5: import path, { resolve, join, isAbsolute, dirname, basename, relative, sep } from 'node:path';
L6: import { l as logger, b as projectPath, d as delay, R as RawJSONLinesSchema, I as InvalidateSync, j as createReplayBuffer, c as configuration, k as AsyncLock, m as generateRepoMap,...
L7: import { spawn, exec, execSync, execFile as execFile$1, execFileSync as execFileSync$1 } from 'node:child_process';
L8: import { createInterface } from 'node:readline';
...
L11: import fs, { watch, mkdir as mkdir$1, writeFile as writeFile$1, unlink, readFile as readFile$1, rename } from 'fs/promises';
L12: import { useStdout, useInput, Box, Text, render } from 'ink';
L13: import React, { useState, useRef, useEffect, useCallback } from 'react';
L14: import axios from 'axios';
L15: import 'node:events';
...
L389: const projectId = resolve(workingDirectory).replace(/[^a-zA-Z0-9-]/g, "-");
L390: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || join(homedir(), ".claude");
L391: return join(claudeConfigDir, "projects", projectId);
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index-BEbnUT5r.mjsView on unpkg · L55import path, { resolve, join, isAbsolute, dirname, basename, relative, sep } from 'node:path';
L6: import { l as logger, b as projectPath, d as delay, R as RawJSONLinesSchema, I as InvalidateSync, j as createReplayBuffer, c as configuration, k as AsyncLock, m as generateRepoMap,...
L7: import { spawn, exec, execSync, execFile as execFile$1, execFileSync as execFileSync$1 } from 'node:child_process';
L8: import { createInterface } from 'node:readline';
...
L11: import fs, { watch, mkdir as mkdir$1, writeFile as writeFile$1, unlink, readFile as readFile$1, rename } from 'fs/promises';
L12: import { useStdout, useInput, Box, Text, render } from 'ink';
L13: import React, { useState, useRef, useEffect, useCallback } from 'react';
L14: import axios from 'axios';
L15: import 'node:events';
...
L389: const projectId = resolve(workingDirectory).replace(/[^a-zA-Z0-9-]/g, "-");
L390: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || join(homedir(), ".claude");
L391: return join(claudeConfigDir, "projects", projectId);
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/index-BEbnUT5r.mjsView on unpkg · L55import path, { resolve, join, isAbsolute, dirname, basename, relative, sep } from 'node:path';
L6: import { l as logger, b as projectPath, d as delay, R as RawJSONLinesSchema, I as InvalidateSync, j as createReplayBuffer, c as configuration, k as AsyncLock, m as generateRepoMap,...
L7: import { spawn, exec, execSync, execFile as execFile$1, execFileSync as execFileSync$1 } from 'node:child_process';
L8: import { createInterface } from 'node:readline';
...
L11: import fs, { watch, mkdir as mkdir$1, writeFile as writeFile$1, unlink, readFile as readFile$1, rename } from 'fs/promises';
L12: import { useStdout, useInput, Box, Text, render } from 'ink';
L13: import React, { useState, useRef, useEffect, useCallback } from 'react';
L14: import axios from 'axios';
L15: import 'node:events';
...
L389: const projectId = resolve(workingDirectory).replace(/[^a-zA-Z0-9-]/g, "-");
L390: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || join(homedir(), ".claude");
L391: return join(claudeConfigDir, "projects", projectId);
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/index-BEbnUT5r.mjsView on unpkg · L5tools/unpacked/ripgrep.nodeView file
•path = tools/unpacked/ripgrep.node
kind = native_binary
sizeBytes = 8555952
magicHex = [redacted]
Medium
scripts/download-tools.shView file
•path = scripts/download-tools.sh
kind = build_helper
sizeBytes = 4241
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
scripts/download-tools.shView on unpkgtools/archives/difftastic-arm64-linux.tar.gzView file
•path = tools/archives/difftastic-arm64-linux.tar.gz
kind = high_entropy_blob
sizeBytes = 11425536
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
tools/archives/difftastic-arm64-linux.tar.gzView on unpkg•path = tools/archives/difftastic-arm64-linux.tar.gz
kind = compressed_blob
sizeBytes = 11425536
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
tools/archives/difftastic-arm64-linux.tar.gzView on unpkgFindings
7 High8 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/happy-dev.mjs
HighShellbin/happy-dev.mjs
HighSame File Env Network Executiondist/index-BEbnUT5r.mjs
HighRemote Agent Bridgedist/index-BEbnUT5r.mjs
HighCross File Remote Execution Contextdist/index-BEbnUT5r.mjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
MediumDynamic Requiredist/runGemini-C43sMCBh.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index-BEbnUT5r.mjs
MediumShips Native Binarytools/unpacked/ripgrep.node
MediumShips Build Helperscripts/download-tools.sh
MediumShips Compressed Blobtools/archives/difftastic-arm64-linux.tar.gz
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/index-BEbnUT5r.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings