registry / @pushary/agent-hooks / 0.48.0

@pushary/agent-hooks@0.48.0

⚠ Under review

Permission hooks for AI coding agents: route tool approvals through Pushary push notifications

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 35 file(s), 280 KB of source, external domains: pushary.com, registry.npmjs.org

Source & flagged code

6 flagged

dist/bin/pushary-claude.jsView file

Lines 30-74javascript

30 return statSync(path).isFile();

31 } catch {

32 return false;

33 }

34};

35var findClaudeBinary = () => {

36 const override = process.env.PUSHARY_CLAUDE_BIN?.trim();

37 if (override) return isFile(override) ? override : null;

38 const pathVar = process.env.PATH ?? "";

39 const exts = process.platform === "win32" ? [".cmd", ".exe", ".bat", ""] : [""];

40 for (const dir of pathVar.split(delimiter)) {

41 if (!dir) continue;

42 for (const ext of exts) {

43 const candidate = join(dir, `claude${ext}`);

44 if (isFile(candidate)) return candidate;

45 }

46 }

47 return null;

48};

50// src/wrapper/spawnClaude.ts

51import { spawn } from "child_process";

52var needsShell = (binary, platform = process.platform) => platform === "win32" && /\.(cmd|bat)$/i.test(binary);

High

Child Process

Package source references child process execution.

dist/bin/pushary-claude.jsView on unpkg · L50

53var spawnClaude = (binary, args2, options) => {

54 if (needsShell(binary)) {

55 return spawn(`"${binary}"`, args2, { ...options, shell: true });

56 }

High

Shell

Package source references shell execution.

dist/bin/pushary-claude.jsView on unpkg · L54

57 return spawn(binary, args2, options);

58};

60// src/wrapper/localPassthrough.ts

61var SIGNAL_NUMBERS = {

62 SIGHUP: 1,

63 SIGINT: 2,

64 SIGQUIT: 3,

65 SIGKILL: 9,

66 SIGTERM: 15

67};

68var FORWARDED_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];

69var runLocalPassthrough = (binary, args2) => {

70 return new Promise((resolve) => {

71 let child;

72 try {

73 child = spawnClaude(binary, args2, {

74 stdio: "inherit",

Lines 104-144javascript

104// src/wrapper/dualMode.ts

105import { basename } from "path";

106

107// src/wrapper/sdkLoader.ts

108import { spawn as spawn2 } from "child_process";

109import { existsSync, mkdirSync, writeFileSync } from "fs";

110import

•matchType = previous_version_dangerous_delta matchedPackage = @pushary/agent-hooks@0.30.0 matchedIdentity = npm:QHB1c2hhcnkvYWdlbnQtaG9va3M:0.30.0 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/pushary-claude.jsView on unpkg

dist/bin/pushary-setup.jsView file

Lines 17-57javascript

17 resolveGlobalBinDir,

18 resolveGlobalBinary

19} from "../chunk-J7JWI3KU.js";

20import {

21 addClaudeMcpServer,

22 addPusharyHooks,

23 addPusharyToolPermissions

24} from "../chunk-7EW3USQF.js";

Source & flagged code

6 flagged · loading source

dist/bin/pushary-claude.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code