registry / @sokdak/happy / 1.1.11-beta.0

@sokdak/happy@1.1.11-beta.0

Mobile and Web client for Claude Code and Codex

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 38 file(s), 1.74 MB of source, external domains: 127.0.0.1, accounts.google.com, api.anthropic.com, api.cluster-fluster.com, api.deepseek.com, api.openai.com, app.happy.engineering, auth.openai.com, claude.ai, console.anthropic.com, developers.google.com, github.com, goo.gle, happy.engineering, oauth2.googleapis.com, registry.npmjs.org, www.googleapis.com

Source & flagged code

9 flagged

package.jsonView file

Lines 108-130json

108 "pkgroll": "^2.14.2",

109 "shx": "^0.3.3",

110 "ts-node": "^10",

111 "tsx": "^4.20.6",

112 "typescript": "5.9.3",

113 "vitest": "^3.2.4"

114 },

115 "publishConfig": {

116 "registry": "https://registry.npmjs.org",

117 "access": "public"

118 },

119 "scripts": {

120 "typecheck": "tsc --noEmit",

121 "bundle:server": "node scripts/bundle-server.cjs",

122 "bundle:server:all": "node scripts/bundle-server.cjs --all-platforms",

123 "bundle:webapp": "node scripts/bundle-webapp.cjs",

124 "build": "shx rm -rf dist && tsc --noEmit && pkgroll",

125 "test": "pnpm run build && vitest run --project unit",

126 "test:integration": "pnpm run build && vitest run --project integration-empty --project integration-plan-mode --project integration-authenticated",

127 "cli:install": "node scripts/install-local.cjs",

128 "postinstall": "node scripts/unpack-tools.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L128

129 }

130}

bin/happy.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

5import { join, dirname } from 'path';

7// Check if we're already running with the flags

8const hasNoWarnings = process.execArgv.includes('--no-warnings');

9const hasNoDeprecation = process.execArgv.includes('--no-deprecation');

High

Shell

Package source references shell execution.

bin/happy.mjsView on unpkg · L7

11if (!hasNoWarnings || !hasNoDeprecation) {

12 // Get path to the actual CLI entrypoint

13 const projectRoot = dirname(dirname(fileURLToPath(import.meta.url)));

14 const entrypoint = join(projectRoot, 'dist', 'index.mjs');

16 // Execute the actual CLI directly with the correct flags

17 try {

18 execFileSync(process.execPath, [

19 '--no-warnings',

20 '--no-deprecation',

21 entrypoint,

22 ...process.argv.slice(2)

23 ], {

24 stdio: 'inherit',

25 env: process.env

26 });

27 } catch (error) {

dist/runAgy-B7SCnOyI.cjsView file

Lines 1-22javascript

1'use strict';

3var node_crypto = require('node:crypto');

4var React = require('react');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runAgy-B7SCnOyI.cjsView on unpkg · L2

5var ink = require('ink');

6var api = require('./types-CRgb4qum.cjs');

7var AcpSessionManager = require('./AcpSessionManager-JF5hSy2d.cjs');

8var index = require('./index-CXNM6wl9.cjs');

9var persistence = require('./persistence-BbyRrWJw.cjs');

10var node_child_process = require('node:child_process');

11var os = require('node:os');

12var path = require('node:path');

13var node_fs = require('node:fs');

14require('axios');

15require('chalk');

16require('fs');

17require('node:util');

18require('node:events');

19require('socket.io-client');

20require('zod');

21require('@slopus/happy-wire');

22require('tweetnacl');

dist/index-Cv5msKie.mjsView file

Lines 1-23javascript

1import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import chalk from 'chalk';

2import os$1, { homedir } from 'node:os';

3import { randomUUID, randomBytes, createHash as createHash$1 } from 'node:crypto';

4import { l as logger, g as getProjectPath, p as projectPath, i as initializeSandbox, w as wrapCommand, I as InvalidateSync, R as RawJSONLinesSchema, f as delay, h as AsyncLock, c as configuration, d as packageJson, e as encodeBase64, j as encodeBase64Url, k as decodeBase64, m as getLocalHappyAgentCredentialPath, r as readLocalHappyAgentCredentials, n as decryptWithDataKey, o as decryptLegacy, q as decrypt, s as hasLocalHappyAgentAuth, t as detectResumeSupport, u as detectCLIAvailability, A as ApiClient, b as connectionState, v as startOfflineReconnection, C as CodexAppServerClient, x as getLat ...

5import spawn$1, { spawn } from 'cross-spawn';

6import path, { join, resolve, relative, isAbsolute, sep, basename, dirname } from 'node:path';

7import { createInterface } from 'node:readline';

8import { existsSync, readFileSync, readdirSync, statSync, mkdirSync, writeFileSync, unlinkSync, rmSync, chmodSync as chmodSync$1 } from 'node:fs';

9import { readFile, mkdir, chmod, writeFile, readdir } from 'node:fs/promises';

10import fs, { watch, access } from 'fs/promises';

11import { useStdout, useInput, Box, Text, render } from 'ink';

12import React, { useState, useRef, useEffect, useCallback } from 'react';

13import { query as query$1, AbortError } from '@anthropic-ai/claude-agent-sdk';

14import axios, { AxiosError } from 'axios';

15import 'node:events';

16import 'socket.io-client';

17import tweetnacl from 'tweetnacl';

18import os, { homedir as homedir$1 } from 'os';

19import { spawn as spawn$2, execSync as execSync$1, exec } from 'child_process';

20import { createEnvelope } from '@slopus/happy-wire';

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index-Cv5msKie.mjsView on unpkg · L3

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index-Cv5msKie.mjsView on unpkg · L3

21import { createId } from '@paralleldrive/cuid2';

22import { statSync as statSync$1, existsSync as existsSync$1, writeFileSync as writeFileSync$1, chmodSync, unlinkSync as unlinkSync$1, mkdirSync as mkdirSync$1 } from 'fs';

23import { join as join$1 } from 'path';

Long lines were clipped for display.

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/unpack-tools.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/happy.mjsView file

2L3: import { execFileSync } from 'child_process'; L4: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

7// Check if we're already running with the flags L8: const hasNoWarnings = process.execArgv.includes('--no-warnings'); L9: const hasNoDeprecation = process.execArgv.includes('--no-deprecation');

High

Shell

Package source references shell execution.

bin/happy.mjsView on unpkg · L7

dist/runAgy-B7SCnOyI.cjsView file

2L3: var node_crypto = require('node:crypto'); L4: var React = require('react');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runAgy-B7SCnOyI.cjsView on unpkg · L2

dist/index-Cv5msKie.mjsView file

3Cross-file remote execution chain: dist/index-Cv5msKie.mjs spawns scripts/claude_local_launcher.cjs; helper contains network access plus dynamic code execution. L3: import { randomUUID, randomBytes, createHash as createHash$1 } from 'node:crypto'; L4: import { l as logger, g as getProjectPath, p as projectPath, i as initializeSandbox, w as wrapCommand, I as InvalidateSync, R as RawJSONLinesSchema, f as delay, h as AsyncLock, c a... L5: import spawn$1, { spawn } from 'cross-spawn'; ... L10: import fs, { watch, access } from 'fs/promises'; L11: import { useStdout, useInput, Box, Text, render } from 'ink'; L12: import React, { useState, useRef, useEffect, useCallback } from 'react'; L13: import { query as query$1, AbortError } from '@anthropic-ai/claude-agent-sdk'; L14: import axios, { AxiosError } from 'axios'; L15: import 'node:events'; ... L18: import os, { homedir as homedir$1 } from 'os'; L19: import { spawn as spawn$2, execSync as execSync$1, exec } from 'child_process'; L20: import { createEnvelope } from '@slopus/happy-wire';

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index-Cv5msKie.mjsView on unpkg · L3

3import { randomUUID, randomBytes, createHash as createHash$1 } from 'node:crypto'; L4: import { l as logger, g as getProjectPath, p as projectPath, i as initializeSandbox, w as wrapCommand, I as InvalidateSync, R as RawJSONLinesSchema, f as delay, h as AsyncLock, c a... L5: import spawn$1, { spawn } from 'cross-spawn'; ... L10: import fs, { watch, access } from 'fs/promises'; L11: import { useStdout, useInput, Box, Text, render } from 'ink'; L12: import React, { useState, useRef, useEffect, useCallback } from 'react'; L13: import { query as query$1, AbortError } from '@anthropic-ai/claude-agent-sdk'; L14: import axios, { AxiosError } from 'axios'; L15: import 'node:events'; ... L18: import os, { homedir as homedir$1 } from 'os'; L19: import { spawn as spawn$2, execSync as execSync$1, exec } from 'child_process'; L20: import { createEnvelope } from '@slopus/happy-wire';

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index-Cv5msKie.mjsView on unpkg · L3

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

Findings

5 High7 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/happy.mjs

HighShellbin/happy.mjs

HighCross File Remote Execution Contextdist/index-Cv5msKie.mjs

HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz

MediumDynamic Requiredist/runAgy-B7SCnOyI.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index-Cv5msKie.mjs

MediumShips Build Helperscripts/download-tools.sh

MediumShips Compressed Blobtools/archives/difftastic-arm64-linux.tar.gz

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

package.jsonView file

Lines 108-130json

108 "pkgroll": "^2.14.2",

109 "shx": "^0.3.3",

110 "ts-node": "^10",

111 "tsx": "^4.20.6",

112 "typescript": "5.9.3",

113 "vitest": "^3.2.4"

114 },

115 "publishConfig": {

116 "registry": "https://registry.npmjs.org",

117 "access": "public"

118 },

119 "scripts": {

120 "typecheck": "tsc --noEmit",

121 "bundle:server": "node scripts/bundle-server.cjs",

122 "bundle:server:all": "node scripts/bundle-server.cjs --all-platforms",

123 "bundle:webapp": "node scripts/bundle-webapp.cjs",

124 "build": "shx rm -rf dist && tsc --noEmit && pkgroll",

125 "test": "pnpm run build && vitest run --project unit",

126 "test:integration": "pnpm run build && vitest run --project integration-empty --project integration-plan-mode --project integration-authenticated",

127 "cli:install": "node scripts/install-local.cjs",

128 "postinstall": "node scripts/unpack-tools.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L128

129 }

130}

bin/happy.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

5import { join, dirname } from 'path';

7// Check if we're already running with the flags

8const hasNoWarnings = process.execArgv.includes('--no-warnings');

9const hasNoDeprecation = process.execArgv.includes('--no-deprecation');

High

Shell

Package source references shell execution.

bin/happy.mjsView on unpkg · L7

11if (!hasNoWarnings || !hasNoDeprecation) {

12 // Get path to the actual CLI entrypoint

13 const projectRoot = dirname(dirname(fileURLToPath(import.meta.url)));

14 const entrypoint = join(projectRoot, 'dist', 'index.mjs');

16 // Execute the actual CLI directly with the correct flags

17 try {

18 execFileSync(process.execPath, [

19 '--no-warnings',

20 '--no-deprecation',

21 entrypoint,

22 ...process.argv.slice(2)

23 ], {

24 stdio: 'inherit',

25 env: process.env

26 });

27 } catch (error) {

dist/runAgy-B7SCnOyI.cjsView file

Lines 1-22javascript

1'use strict';

3var node_crypto = require('node:crypto');

4var React = require('react');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runAgy-B7SCnOyI.cjsView on unpkg · L2

5var ink = require('ink');

6var api = require('./types-CRgb4qum.cjs');

7var AcpSessionManager = require('./AcpSessionManager-JF5hSy2d.cjs');

8var index = require('./index-CXNM6wl9.cjs');

9var persistence = require('./persistence-BbyRrWJw.cjs');

10var node_child_process = require('node:child_process');

11var os = require('node:os');

12var path = require('node:path');

13var node_fs = require('node:fs');

14require('axios');

15require('chalk');

16require('fs');

17require('node:util');

18require('node:events');

19require('socket.io-client');

20require('zod');

21require('@slopus/happy-wire');

22require('tweetnacl');

dist/index-Cv5msKie.mjsView file

Lines 1-23javascript

1import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import chalk from 'chalk';

2import os$1, { homedir } from 'node:os';

3import { randomUUID, randomBytes, createHash as createHash$1 } from 'node:crypto';

5import spawn$1, { spawn } from 'cross-spawn';

6import path, { join, resolve, relative, isAbsolute, sep, basename, dirname } from 'node:path';

7import { createInterface } from 'node:readline';

8import { existsSync, readFileSync, readdirSync, statSync, mkdirSync, writeFileSync, unlinkSync, rmSync, chmodSync as chmodSync$1 } from 'node:fs';

9import { readFile, mkdir, chmod, writeFile, readdir } from 'node:fs/promises';

10import fs, { watch, access } from 'fs/promises';

11import { useStdout, useInput, Box, Text, render } from 'ink';

12import React, { useState, useRef, useEffect, useCallback } from 'react';

13import { query as query$1, AbortError } from '@anthropic-ai/claude-agent-sdk';

14import axios, { AxiosError } from 'axios';

15import 'node:events';

16import 'socket.io-client';

17import tweetnacl from 'tweetnacl';

18import os, { homedir as homedir$1 } from 'os';

19import { spawn as spawn$2, execSync as execSync$1, exec } from 'child_process';

20import { createEnvelope } from '@slopus/happy-wire';

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index-Cv5msKie.mjsView on unpkg · L3

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index-Cv5msKie.mjsView on unpkg · L3

21import { createId } from '@paralleldrive/cuid2';

22import { statSync as statSync$1, existsSync as existsSync$1, writeFileSync as writeFileSync$1, chmodSync, unlinkSync as unlinkSync$1, mkdirSync as mkdirSync$1 } from 'fs';

23import { join as join$1 } from 'path';

Long lines were clipped for display.

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg