registry / @sokdak/happy / 1.1.11-beta.0

@sokdak/happy@1.1.11-beta.0

Mobile and Web client for Claude Code and Codex

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 38 file(s), 1.74 MB of source, external domains: 127.0.0.1, accounts.google.com, api.anthropic.com, api.cluster-fluster.com, api.deepseek.com, api.openai.com, app.happy.engineering, auth.openai.com, claude.ai, console.anthropic.com, developers.google.com, github.com, goo.gle, happy.engineering, oauth2.googleapis.com, registry.npmjs.org, www.googleapis.com

Source & flagged code

9 flagged

package.jsonView file

Lines 108-130json

108 "pkgroll": "^2.14.2",

109 "shx": "^0.3.3",

110 "ts-node": "^10",

111 "tsx": "^4.20.6",

112 "typescript": "5.9.3",

113 "vitest": "^3.2.4"

114 },

115 "publishConfig": {

116 "registry": "https://registry.npmjs.org",

117 "access": "public"

118 },

119 "scripts": {

120 "typecheck": "tsc --noEmit",

121 "bundle:server": "node scripts/bundle-server.cjs",

122 "bundle:server:all": "node scripts/bundle-server.cjs --all-platforms",

123 "bundle:webapp": "node scripts/bundle-webapp.cjs",

124 "build": "shx rm -rf dist && tsc --noEmit && pkgroll",

125 "test": "pnpm run build && vitest run --project unit",

126 "test:integration": "pnpm run build && vitest run --project integration-empty --project integration-plan-mode --project integration-authenticated",

127 "cli:install": "node scripts/install-local.cjs",

128 "postinstall": "node scripts/unpack-tools.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L128

129 }

130}

bin/happy.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

5import { join, dirname } from 'path';

7// Check if we're already running with the flags

dist/runAgy-B7SCnOyI.cjsView file

Lines 1-22javascript

1'use strict';

3var node_crypto = require('node:crypto');

4var React = require('react');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runAgy-B7SCnOyI.cjsView on unpkg · L2

5var ink = require(

dist/index-Cv5msKie.mjsView file

Lines 1-23javascript

1import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import chalk from 'chalk';

2import os$1, { homedir } from 'node:os';

3import { randomUUID, randomBytes, createHash as createHash$1 } from 'node:crypto'

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/unpack-tools.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/happy.mjsView file

2L3: import { execFileSync } from 'child_process'; L4: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

7// Check if we're already running with the flags L8: const hasNoWarnings = process.execArgv.includes('--no-warnings'); L9: const hasNoDeprecation = process.execArgv.includes('--no-deprecation');

High

Shell

Package source references shell execution.

bin/happy.mjsView on unpkg · L7

dist/runAgy-B7SCnOyI.cjsView file

2L3: var node_crypto = require('node:crypto'); L4: var React = require('react');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runAgy-B7SCnOyI.cjsView on unpkg · L2

dist/index-Cv5msKie.mjsView file

3Cross-file remote execution chain: dist/index-Cv5msKie.mjs spawns scripts/claude_local_launcher.cjs; helper contains network access plus dynamic code execution. L3: import { randomUUID, randomBytes, createHash as createHash$1 } from 'node:crypto'; L4: import { l as logger, g as getProjectPath, p as projectPath, i as initializeSandbox, w as wrapCommand, I as InvalidateSync, R as RawJSONLinesSchema, f as delay, h as AsyncLock, c a... L5: import spawn$1, { spawn } from 'cross-spawn'; ... L10: import fs, { watch, access } from 'fs/promises'; L11: import { useStdout, useInput, Box, Text, render } from 'ink'; L12: import React, { useState, useRef, useEffect, useCallback } from 'react'; L13: import { query as query$1, AbortError } from '@anthropic-ai/claude-agent-sdk'; L14: import axios, { AxiosError } from 'axios'; L15: import 'node:events'; ... L18: import os, { homedir as homedir$1 } from 'os'; L19: import { spawn as spawn$2, execSync as execSync$1, exec } from 'child_process'; L20: import { createEnvelope } from '@slopus/happy-wire';

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index-Cv5msKie.mjsView on unpkg · L3

3import { randomUUID, randomBytes, createHash as createHash$1 } from 'node:crypto'; L4: import { l as logger, g as getProjectPath, p as projectPath, i as initializeSandbox, w as wrapCommand, I as InvalidateSync, R as RawJSONLinesSchema, f as delay, h as AsyncLock, c a... L5: import spawn$1, { spawn } from 'cross-spawn'; ... L10: import fs, { watch, access } from 'fs/promises'; L11: import { useStdout, useInput, Box, Text, render } from 'ink'; L12: import React, { useState, useRef, useEffect, useCallback } from 'react'; L13: import { query as query$1, AbortError } from '@anthropic-ai/claude-agent-sdk'; L14: import axios, { AxiosError } from 'axios'; L15: import 'node:events'; ... L18: import os, { homedir as homedir$1 } from 'os'; L19: import { spawn as spawn$2, execSync as execSync$1, exec } from 'child_process'; L20: import { createEnvelope } from '@slopus/happy-wire';

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index-Cv5msKie.mjsView on unpkg · L3

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

Findings

5 High7 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/happy.mjs

HighShellbin/happy.mjs

HighCross File Remote Execution Contextdist/index-Cv5msKie.mjs

HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz

MediumDynamic Requiredist/runAgy-B7SCnOyI.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index-Cv5msKie.mjs

MediumShips Build Helperscripts/download-tools.sh

MediumShips Compressed Blobtools/archives/difftastic-arm64-linux.tar.gz

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

package.jsonView file

Lines 108-130json

108 "pkgroll": "^2.14.2",

109 "shx": "^0.3.3",

110 "ts-node": "^10",

111 "tsx": "^4.20.6",

112 "typescript": "5.9.3",

113 "vitest": "^3.2.4"

114 },

115 "publishConfig": {

116 "registry": "https://registry.npmjs.org",

117 "access": "public"

118 },

119 "scripts": {

120 "typecheck": "tsc --noEmit",

121 "bundle:server": "node scripts/bundle-server.cjs",

122 "bundle:server:all": "node scripts/bundle-server.cjs --all-platforms",

123 "bundle:webapp": "node scripts/bundle-webapp.cjs",

124 "build": "shx rm -rf dist && tsc --noEmit && pkgroll",

125 "test": "pnpm run build && vitest run --project unit",

126 "test:integration": "pnpm run build && vitest run --project integration-empty --project integration-plan-mode --project integration-authenticated",

127 "cli:install": "node scripts/install-local.cjs",

128 "postinstall": "node scripts/unpack-tools.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L128

129 }

130}

bin/happy.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

5import { join, dirname } from 'path';

7// Check if we're already running with the flags

dist/runAgy-B7SCnOyI.cjsView file

Lines 1-22javascript

1'use strict';

3var node_crypto = require('node:crypto');

4var React = require('react');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runAgy-B7SCnOyI.cjsView on unpkg · L2

5var ink = require(

dist/index-Cv5msKie.mjsView file

Lines 1-23javascript

1import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import chalk from 'chalk';

2import os$1, { homedir } from 'node:os';

3import { randomUUID, randomBytes, createHash as createHash$1 } from 'node:crypto'

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg