registry / @pushary/agent-hooks / 0.49.1

@pushary/agent-hooks@0.49.1

⚠ Under review

Permission hooks for AI coding agents: route tool approvals through Pushary push notifications

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 39 file(s), 292 KB of source, external domains: pushary.com, registry.npmjs.org

Source & flagged code

9 flagged

dist/bin/pushary-claude.jsView file

Lines 83-140javascript

83 for (const signal of FORWARDED_SIGNALS) process.on(signal, forward);

84 const cleanup = () => {

85 for (const signal of FORWARDED_SIGNALS) process.off(signal, forward);

86 };

87 child.on("error", () => {

88 cleanup();

89 resolve(127);

90 });

91 child.on("exit", (code, signal) => {

92 cleanup();

93 if (typeof code === "number") resolve(code);

94 else if (signal) resolve(128 + (SIGNAL_NUMBERS[signal] ?? 0));

95 else resolve(0);

96 });

97 });

98};

100// src/wrapper/dualMode.ts

101import { basename } from "path";

102

103// src/wrapper/sdkLoader.ts

104import { spawn } from "child_process";

105import { existsSync, mkdirSync, writeFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/bin/pushary-claude.jsView on unpkg · L103

106import { homedir } from "os";

107import { join as join2 } from "path";

108import { pathToFileURL } from "url";

109var userMessage = (text) => ({

110 type: "user",

111 message: { role: "user", content: text },

112 parent_tool_use_id: null

113});

114var SDK_VERSION = "0.3.207";

115var SDK_PACKAGE = "@anthropic-ai/claude-agent-sdk";

116var SDK_SPEC = `${SDK_PACKAGE}@${SDK_VERSION}`;

117var sdkCacheDir = () => process.env.PUSHARY_REMOTE_SDK_DIR?.trim() || join2(homedir(), ".pushary", "remote-sdk");

118var cachedSdkEntry = () => join2(sdkCacheDir(), "node_modules", "@anthropic-ai", "claude-agent-sdk", "sdk.mjs");

119var importSdk = async (specifierOrUrl) => {

120 try {

121 const mod = await import(specifierOrUrl);

122 if (typeof mod.query === "function") return mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/pushary-claude.jsView on unpkg · L120

123 if (mod.default && typeof mod.default.query === "function") return mod.default;

124 return null;

125 } catch {

126 return null;

127 }

128};

129var loadClaudeSdk = async () => {

130 const fromResolution = await importSdk(SDK_PACKAGE);

131 if (fromResolution) return fromResolution;

132 const entry = cachedSdkEntry();

133 if (existsSync(entry)) return importSdk(pathToFileURL(entry).href);

134 return null;

135};

136var ensureClaudeSdk = async (log) => {

137 const present = await loadClaudeSdk();

138 if (present) return present;

139 const dir = sdkCacheDir();

140 try {

•matchType = previous_version_dangerous_delta matchedPackage = @pushary/agent-hooks@0.30.0 matchedIdentity = npm:QHB1c2hhcnkvYWdlbnQtaG9va3M:0.30.0 similarity = 0.429 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/pushary-claude.jsView on unpkg

dist/chunk-XHKBHWLX.jsView file

Lines 1-15javascript

1// src/wrapper/spawnClaude.ts

2import { spawn } from "child_process";

3var needsShell = (binary, platform = process.platform) => platform === "win32" &&

dist/chunk-BC3VCZ3E.jsView file

Lines 1-26javascript

1// src/shell-alias.ts

2import { homedir } from "os";

3import { existsSync, readFileSync, appendFileSync, writeFileSync } from "fs";

4import { join } from "path";

5var MARKER_START

dist/bin/pushary-daemon.jsView file

Lines 39-79javascript

39 apiKey = getApiKey();

40 } catch {

41 stderr("[pushary] daemon needs an API key. Run `npx @pushary/agent-hooks setup`.\n");

42 return 1;

43 }

dist/bin/pushary-setup.jsView file

Lines 22-62javascript

22 resolveGlobalBinary

23} from "../chunk-J7JWI3KU.js";

24import {

25 addClaudeMcpServer,

26 addPusharyHooks,

27 addPusharyToolPermissions

28} from "../chunk-7EW3USQF.js";

29import {

Source & flagged code

9 flagged · loading source

dist/bin/pushary-claude.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code