registry / @pushary/agent-hooks / 0.40.0

@pushary/agent-hooks@0.40.0

⚠ Under review

Permission hooks for AI coding agents: route tool approvals through Pushary push notifications

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 36 file(s), 257 KB of source, external domains: pushary.com, registry.npmjs.org

Source & flagged code

5 flagged

dist/bin/pushary-claude.jsView file

Lines 29-69javascript

29 return statSync(path).isFile();

30 } catch {

31 return false;

32 }

33};

34var findClaudeBinary = () => {

35 const override = process.env.PUSHARY_CLAUDE_BIN?.trim();

36 if (override) return isFile(override) ? override : null;

37 const pathVar = process.env.PATH ?? "";

38 const exts = process.platform === "win32" ? [".cmd", ".exe", ".bat", ""] : [""];

39 for (const dir of pathVar.split(delimiter)) {

40 if (!dir) continue;

41 for (const ext of exts) {

42 const candidate = join(dir, `claude${ext}`);

43 if (isFile(candidate)) return candidate;

44 }

45 }

46 return null;

47};

49// src/wrapper/localPassthrough.ts

50import { spawn } from "child_process";

51var SIGNAL_NUMBERS = {

High

Child Process

Package source references child process execution.

dist/bin/pushary-claude.jsView on unpkg · L49

52 SIGHUP: 1,

53 SIGINT: 2,

54 SIGQUIT: 3,

55 SIGKILL: 9,

56 SIGTERM: 15

57};

58var FORWARDED_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];

59var runLocalPassthrough = (binary, args2) => {

60 return new Promise((resolve) => {

61 let child;

62 try {

63 child = spawn(binary, args2, {

64 stdio: "inherit",

65 env: { ...process.env, [WRAPPER_ACTIVE_ENV]: "1" }

66 });

67 } catch {

68 resolve(127);

69 return;

Lines 85-125javascript

85 child.on("exit", (code, signal) => {

86 cleanup();

87 if (typeof code === "number") resolve(code);

88 else if

•matchType = previous_version_dangerous_delta matchedPackage = @pushary/agent-hooks@0.30.0 matchedIdentity = npm:QHB1c2hhcnkvYWdlbnQtaG9va3M:0.30.0 similarity = 0.429 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/pushary-claude.jsView on unpkg

dist/bin/pushary-setup.jsView file

Lines 18-58javascript

18 resolveGlobalBinary

19} from "../chunk-J7JWI3KU.js";

20import {

21 addClaudeMcpServer,

22 addPusharyHooks,

23 addPusharyToolPermissions

24} from "../chunk-7EW3USQF.js";

25import {

Source & flagged code

5 flagged · loading source

dist/bin/pushary-claude.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code