registry / @pushary/agent-hooks / 0.36.0

@pushary/agent-hooks@0.36.0

⚠ Under review

Permission hooks for AI coding agents: route tool approvals through Pushary push notifications

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 228 KB of source, external domains: pushary.com, registry.npmjs.org

Source & flagged code

4 flagged

dist/bin/pushary-claude.jsView file

Lines 12-52javascript

12 return statSync(path).isFile();

13 } catch {

14 return false;

15 }

16};

17var findClaudeBinary = () => {

18 const override = process.env.PUSHARY_CLAUDE_BIN?.trim();

19 if (override) return isFile(override) ? override : null;

20 const pathVar = process.env.PATH ?? "";

21 const exts = process.platform === "win32" ? [".cmd", ".exe", ".bat", ""] : [""];

22 for (const dir of pathVar.split(delimiter)) {

23 if (!dir) continue;

24 for (const ext of exts) {

25 const candidate = join(dir, `claude${ext}`);

26 if (isFile(candidate)) return candidate;

27 }

28 }

29 return null;

30};

32// src/wrapper/localPassthrough.ts

33import { spawn } from "child_process";

34var SIGNAL_NUMBERS = {

High

Child Process

Package source references child process execution.

dist/bin/pushary-claude.jsView on unpkg · L32

35 SIGHUP: 1,

36 SIGINT: 2,

37 SIGQUIT: 3,

38 SIGKILL: 9,

39 SIGTERM: 15

40};

41var FORWARDED_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];

42var runLocalPassthrough = (binary, args2) => {

43 return new Promise((resolve) => {

44 let child;

45 try {

46 child = spawn(binary, args2, {

47 stdio: "inherit",

48 env: { ...process.env, [WRAPPER_ACTIVE_ENV]: "1" }

49 });

50 } catch {

51 resolve(127);

52 return;

dist/bin/pushary-setup.jsView file

Lines 17-57javascript

17} from "../chunk-SVVEC4QV.js";

18import {

19 execNpm,

20 npmErrorMessage,

21 quoteIfNeeded,

22 resolveGlobalBinDir,

23 resolveGlobalBinary

24} from "../chunk-J7JWI3KU.js";

25import

Source & flagged code

4 flagged · loading source

dist/bin/pushary-claude.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code