registry / @pushary/agent-hooks / 0.25.0

@pushary/agent-hooks@0.25.0

Permission hooks for AI coding agents: route tool approvals through Pushary push notifications

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 100 file(s), 732 KB of source, external domains: pushary.com, registry.npmjs.org

Source & flagged code

2 flagged

dist/bin/pushary-clean.jsView file

Lines 4-44javascript

4 removePusharySettings

5} from "../chunk-5MA3CPZB.js";

6import {

7 execNpm,

8 removeCodexHooks,

9 removeGeminiSettings,

10 removeInstructionBlock

11} from "../chunk-JPRRYC5X.js";

13// bin/pushary-clean.ts

14import { existsSync, readFileSync, writeFileSync, rmSync } from "fs";

15import { join } from "path";

16import { homedir } from "os";

17import { confirm } from "@inquirer/prompts";

18import { parse as parseTOML, stringify as stringifyTOML } from "smol-toml";

19var dim = (s) => `\x1B[2m${s}\x1B[0m`;

20var bold = (s) => `\x1B[1m${s}\x1B[0m`;

21var green = (s) => `\x1B[32m${s}\x1B[0m`;

22var yellow = (s) => `\x1B[33m${s}\x1B[0m`;

23var check = green("\u2713");

24var skip = yellow("\u2013");

25var CLAUDE_SETTINGS = join(homedir(), ".claude", "settings.json");

26var CLAUDE_SETTINGS_LOCAL = join(homedir(), ".claude", "settings.local.json");

27var CLAUDE_JSON = join(homedir(), ".claude.json");

28var SKILL_DIR = join(homedir(), ".claude", "skills", "pushary");

29var CURSOR_MCP = join(".cursor", "mcp.json");

30var CURSOR_PLUGIN_DIR = join(homedir(), ".cursor", "plugins", "local", "pushary");

31var SHELL_FILES = [".zshrc", ".zprofile", ".bashrc", ".bash_profile"].map((f) => join(homedir(), f));

32var readJson = (path) => {

33 try {

34 return JSON.parse(readFileSync(path, "utf-8"));

35 } catch {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/bin/pushary-clean.jsView on unpkg · L24

36 return null;

37 }

38};

39var writeJson = (path, data) => {

40 writeFileSync(path, JSON.stringify(data, null, 2) + "\n", "utf-8");

41};

42var cleanSettingsFile = (path, label) => {

43 const data = readJson(path);

44 if (!data) {

dist/bin/pushary-setup.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pushary/agent-hooks@0.23.0 matchedIdentity = npm:QHB1c2hhcnkvYWdlbnQtaG9va3M:0.23.0 similarity = 0.727 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/pushary-setup.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/bin/pushary-clean.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code