registry / @kmmao/happy-coder / 0.102.30

@kmmao/happy-coder@0.102.30

⚠ Under review

Mobile and Web client for Claude Code and Codex

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 22 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 4.11 MB of source, external domains: 127.0.0.1, accounts.google.com, api.github.com, api.openai.com, auth.openai.com, claude.ai, console.anthropic.com, developers.google.com, github.com, goo.gle, happy.engineering, oauth2.googleapis.com, registry.npmjs.org, s.sangreal.code.xycloud.info, w.sangreal.code.xycloud.info, www.apple.com, www.googleapis.com

Source & flagged code

14 flagged

package.jsonView file

•scripts.postinstall = node scripts/unpack-tools.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/happy-dev.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy-dev.mjsView on unpkg · L2

5import { join, dirname } from 'path';

6import { homedir } from 'os';

8// Check if we're already running with the flags

9const hasNoWarnings = process.execArgv.includes('--no-warnings');

10const hasNoDeprecation = process.execArgv.includes('--no-deprecation');

High

Shell

Package source references shell execution.

bin/happy-dev.mjsView on unpkg · L8

12if (!hasNoWarnings || !hasNoDeprecation) {

13 // Re-execute with the flags

14 const __filename = fileURLToPath(import.meta.url);

15 const scriptPath = join(dirname(__filename), '../dist/index.mjs');

17 // Set development environment variables

18 process.env.HAPPY_HOME_DIR = join(homedir(), '.happy-dev');

19 process.env.HAPPY_VARIANT = 'dev';

21 try {

22 execFileSync(

23 process.execPath,

24 ['--no-warnings', '--no-deprecation', scriptPath, ...process.argv.slice(2)],

25 {

26 stdio: 'inherit',

27 env: process.env

28 }

dist/constants-B6XbYuWX.cjsView file

2L3: var index = require('./index-q-oM6mud.cjs'); L4:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/constants-B6XbYuWX.cjsView on unpkg · L2

dist/types-ZsJvn5Rz.mjsView file

1import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import axios from 'axios'; L2: import chalk from 'chalk'; ... L10: import { io } from 'socket.io-client'; L11: import { randomBytes, createDecipheriv, createCipheriv, randomUUID } from 'node:crypto'; L12: import tweetnacl from 'tweetnacl'; L13: import { createId } from '@paralleldrive/cuid2'; L14: import { execFile, spawn as spawn$3 } from 'node:child_process'; L15: import { promisify } from 'node:util'; ... L272: "tools", L273: "package.json" L274: ]; ... L414: this.isDaemonProcess = args.length >= 2 && args[0] === "daemon" && args[1] === "start-sync";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/types-ZsJvn5Rz.mjsView on unpkg · L1

dist/index-q-oM6mud.cjsView file

28627L28628: const execAsync$1 = util.promisify(child_process.exec); L28629: const CLIENT_ID = "681255809395-[redacted].apps.googleusercontent.com"; L28630: const CLIENT_SECRET = process.env.GOOGLE_OAUTH_CLIENT_SECRET ?? ""; L28631: const AUTHORIZE_URL = "https://accounts.google.com/o/oauth2/v2/auth"; L28632: const TOKEN_URL = "https://oauth2.googleapis.com/token";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index-q-oM6mud.cjsView on unpkg · L28627

8var api = require('./types-Cy5ZfLTn.cjs'); L9: var node_child_process = require('node:child_process'); L10: var node_readline = require('node:readline'); ... L448: } L449: const sessionData = fs.readFileSync(sessionFile, "utf-8").split("\n"); L450: const hasGoodMessage = !!sessionData.find((v, index) => { ... L3570: const attachedTerminals = /* @__PURE__ */ new Map(); L3571: let reconnectBaseUrl = null; L3572: let reconnectInflight = null;

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index-q-oM6mud.cjsView on unpkg · L8

8Cross-file remote execution chain: dist/index-q-oM6mud.cjs spawns dist/runCodex-dBVp3vJN.cjs; helper contains network access plus dynamic code execution. L8: var api = require('./types-Cy5ZfLTn.cjs'); L9: var node_child_process = require('node:child_process'); L10: var node_readline = require('node:readline'); ... L15: var React = require('react'); L16: var axios = require('axios'); L17: require('node:events'); ... L436: const projectId = path.resolve(workingDirectory).replace(/[^a-zA-Z0-9-]/g, "-"); L437: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude"); L438: return path.join(claudeConfigDir, "projects", projectId); ... L452: try { L453: const parsed = JSON.parse(v); L454: return typeof parsed.uuid === "string" && parsed.uuid.length > 0 || // Claude Code 2.1.x

tools/unpacked/ripgrep.nodeView file

•path = tools/unpacked/ripgrep.node kind = native_binary sizeBytes = 8555952 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

tools/unpacked/ripgrep.nodeView on unpkg

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/config-BZPQqdBF.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @kmmao/happy-coder@0.102.10 matchedIdentity = npm:QGttbWFvL2hhcHB5LWNvZGVy:0.102.10 similarity = 0.560 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/config-BZPQqdBF.cjsView on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/unpack-tools.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/happy-dev.mjsView file

2L3: import { execFileSync } from 'child_process'; L4: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy-dev.mjsView on unpkg · L2

8// Check if we're already running with the flags L9: const hasNoWarnings = process.execArgv.includes('--no-warnings'); L10: const hasNoDeprecation = process.execArgv.includes('--no-deprecation');

High

Shell

Package source references shell execution.

bin/happy-dev.mjsView on unpkg · L8

dist/constants-B6XbYuWX.cjsView file

2L3: var index = require('./index-q-oM6mud.cjs'); L4:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/constants-B6XbYuWX.cjsView on unpkg · L2

dist/types-ZsJvn5Rz.mjsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/types-ZsJvn5Rz.mjsView on unpkg · L1

dist/index-q-oM6mud.cjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index-q-oM6mud.cjsView on unpkg · L28627

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index-q-oM6mud.cjsView on unpkg · L8

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index-q-oM6mud.cjsView on unpkg · L8

8var api = require('./types-Cy5ZfLTn.cjs'); L9: var node_child_process = require('node:child_process'); L10: var node_readline = require('node:readline'); ... L15: var React = require('react'); L16: var axios = require('axios'); L17: require('node:events'); ... L436: const projectId = path.resolve(workingDirectory).replace(/[^a-zA-Z0-9-]/g, "-"); L437: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude"); L438: return path.join(claudeConfigDir, "projects", projectId); ... L452: try { L453: const parsed = JSON.parse(v); L454: return typeof parsed.uuid === "string" && parsed.uuid.length > 0 || // Claude Code 2.1.x

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index-q-oM6mud.cjsView on unpkg · L8

tools/unpacked/ripgrep.nodeView file

•path = tools/unpacked/ripgrep.node kind = native_binary sizeBytes = 8555952 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

tools/unpacked/ripgrep.nodeView on unpkg

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/config-BZPQqdBF.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/config-BZPQqdBF.cjsView on unpkg

Findings

1 Critical7 High8 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/config-BZPQqdBF.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/happy-dev.mjs

HighShellbin/happy-dev.mjs

HighSame File Env Network Executiondist/index-q-oM6mud.cjs

HighRemote Agent Bridgedist/index-q-oM6mud.cjs

HighCross File Remote Execution Contextdist/index-q-oM6mud.cjs

HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz

MediumDynamic Requiredist/constants-B6XbYuWX.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index-q-oM6mud.cjs

MediumShips Native Binarytools/unpacked/ripgrep.node

MediumShips Build Helperscripts/download-tools.sh

MediumShips Compressed Blobtools/archives/difftastic-arm64-linux.tar.gz

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/types-ZsJvn5Rz.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

14 flagged

package.jsonView file

•scripts.postinstall = node scripts/unpack-tools.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/happy-dev.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy-dev.mjsView on unpkg · L2

5import { join, dirname } from 'path';

6import { homedir } from 'os';

8// Check if we're already running with the flags

9const hasNoWarnings = process.execArgv.includes('--no-warnings');

10const hasNoDeprecation = process.execArgv.includes('--no-deprecation');

High

Shell

Package source references shell execution.

bin/happy-dev.mjsView on unpkg · L8

12if (!hasNoWarnings || !hasNoDeprecation) {

13 // Re-execute with the flags

14 const __filename = fileURLToPath(import.meta.url);

15 const scriptPath = join(dirname(__filename), '../dist/index.mjs');

17 // Set development environment variables

18 process.env.HAPPY_HOME_DIR = join(homedir(), '.happy-dev');

19 process.env.HAPPY_VARIANT = 'dev';

21 try {

22 execFileSync(

23 process.execPath,

24 ['--no-warnings', '--no-deprecation', scriptPath, ...process.argv.slice(2)],

25 {

26 stdio: 'inherit',

27 env: process.env

28 }

dist/constants-B6XbYuWX.cjsView file

2L3: var index = require('./index-q-oM6mud.cjs'); L4:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/constants-B6XbYuWX.cjsView on unpkg · L2

dist/types-ZsJvn5Rz.mjsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/types-ZsJvn5Rz.mjsView on unpkg · L1

dist/index-q-oM6mud.cjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index-q-oM6mud.cjsView on unpkg · L28627

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index-q-oM6mud.cjsView on unpkg · L8

tools/unpacked/ripgrep.nodeView file

•path = tools/unpacked/ripgrep.node kind = native_binary sizeBytes = 8555952 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

tools/unpacked/ripgrep.nodeView on unpkg

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/config-BZPQqdBF.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/config-BZPQqdBF.cjsView on unpkg