registry / claudeputer / 1.1.4

claudeputer@1.1.4

Mobile and Web client for Claude Code and Codex (fork of happy)

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 37 file(s), 1.67 MB of source, external domains: 127.0.0.1, accounts.google.com, api.anthropic.com, api.cluster-fluster.com, api.deepseek.com, api.openai.com, api.z.ai, app.happy.engineering, auth.openai.com, claude.ai, console.anthropic.com, developers.google.com, github.com, goo.gle, happy.engineering, oauth2.googleapis.com, registry.npmjs.org, www.apple.com, www.googleapis.com

Source & flagged code

9 flagged

package.jsonView file

Lines 52-92json

52 },

53 "files": [

54 "dist",

55 "bin",

56 "scripts",

57 "tools/archives",

58 "tools/licenses",

59 "package.json"

60 ],

61 "scripts": {

62 "why do we need to build before running tests / dev?": "We need the binary to be built so we run daemon commands which directly run the binary - we don't want them to go out of sync or have custom spawn logic depending how we started happy",

63 "typecheck": "tsc --noEmit",

64 "build": "shx rm -rf dist && tsc --noEmit && pkgroll",

65 "test": "$npm_execpath run build && vitest run",

66 "start": "$npm_execpath run build && node ./bin/happy.mjs",

67 "cli": "tsx src/index.ts",

68 "dev": "tsx src/index.ts",

69 "dev:local-server": "$npm_execpath run build && tsx --env-file .env.dev-local-server src/index.ts",

70 "prepublishOnly": "$npm_execpath run build && $npm_execpath test",

71 "release": "npx --no-install release-it",

72 "postinstall": "node scripts/unpack-tools.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L72

73 "// ==== Dev/Stable Variant Management ====": "echo comment",

74 "stable": "node scripts/env-wrapper.cjs stable",

75 "dev:variant": "node scripts/env-wrapper.cjs dev",

76 "// ==== Stable Version Quick Commands ====": "echo comment",

77 "stable:daemon:start": "node scripts/env-wrapper.cjs stable daemon start",

78 "stable:daemon:stop": "node scripts/env-wrapper.cjs stable daemon stop",

79 "stable:daemon:status": "node scripts/env-wrapper.cjs stable daemon status",

80 "stable:auth": "node scripts/env-wrapper.cjs stable auth",

81 "// ==== Development Version Quick Commands ====": "echo comment",

82 "dev:daemon:start": "node scripts/env-wrapper.cjs dev daemon start",

83 "dev:daemon:stop": "node scripts/env-wrapper.cjs dev daemon stop",

84 "dev:daemon:status": "node scripts/env-wrapper.cjs dev daemon status",

85 "dev:auth": "node scripts/env-wrapper.cjs dev auth",

86 "// ==== Setup ====": "echo comment",

87 "setup:dev": "node scripts/setup-dev.cjs",

88 "doctor": "node scripts/env-wrapper.cjs stable doctor",

89 "// ==== Development Linking ====": "echo comment",

90 "link:dev": "node scripts/link-dev.cjs",

91 "unlink:dev": "node scripts/link-dev.cjs unlink"

92 },

bin/happy-dev.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy-dev.mjsView on unpkg · L2

5import { join, dirname } from 'path';

6import { homedir } from

dist/config-Cx95TTHK.cjsView file

Lines 1-22javascript

1'use strict';

3var fs = require('fs');

4var path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config-Cx95TTHK.cjsView on unpkg · L2

5var os = require('os'

dist/index-C_CY6KrL.cjsView file

Lines 1-26javascript

1'use strict';

3var chalk = require('chalk');

4var os = require('node:os');

5var node_crypto = require('node:crypto');

6var api = require

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/unpack-tools.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/happy-dev.mjsView file

2L3: import { execFileSync } from 'child_process'; L4: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy-dev.mjsView on unpkg · L2

8// Check if we're already running with the flags L9: const hasNoWarnings = process.execArgv.includes('--no-warnings'); L10: const hasNoDeprecation = process.execArgv.includes('--no-deprecation');

High

Shell

Package source references shell execution.

bin/happy-dev.mjsView on unpkg · L8

dist/config-Cx95TTHK.cjsView file

2L3: var fs = require('fs'); L4: var path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config-Cx95TTHK.cjsView on unpkg · L2

dist/index-C_CY6KrL.cjsView file

6Cross-file remote execution chain: dist/index-C_CY6KrL.cjs spawns scripts/claude_local_launcher.cjs; helper contains network access plus dynamic code execution. L6: var api = require('./types-DuTxA2Rc.cjs'); L7: var node_child_process = require('node:child_process'); L8: var node_path = require('node:path'); ... L16: var node_url = require('node:url'); L17: var axios = require('axios'); L18: require('node:events'); ... L346: const projectId = node_path.resolve(workingDirectory).replace(/[^a-zA-Z0-9-]/g, "-"); L347: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || node_path.join(os.homedir(), ".claude"); L348: return node_path.join(claudeConfigDir, "projects", projectId); ... L362: try { L363: const parsed = JSON.parse(v); L364: return typeof parsed.uuid === "string" && parsed.uuid.length > 0 || // Claude Code 2.1.x

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index-C_CY6KrL.cjsView on unpkg · L6

6var api = require('./types-DuTxA2Rc.cjs'); L7: var node_child_process = require('node:child_process'); L8: var node_path = require('node:path'); ... L16: var node_url = require('node:url'); L17: var axios = require('axios'); L18: require('node:events'); ... L346: const projectId = node_path.resolve(workingDirectory).replace(/[^a-zA-Z0-9-]/g, "-"); L347: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || node_path.join(os.homedir(), ".claude"); L348: return node_path.join(claudeConfigDir, "projects", projectId); ... L362: try { L363: const parsed = JSON.parse(v); L364: return typeof parsed.uuid === "string" && parsed.uuid.length > 0 || // Claude Code 2.1.x

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index-C_CY6KrL.cjsView on unpkg · L6

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

Findings

5 High7 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/happy-dev.mjs

HighShellbin/happy-dev.mjs

HighCross File Remote Execution Contextdist/index-C_CY6KrL.cjs

HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz

MediumDynamic Requiredist/config-Cx95TTHK.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index-C_CY6KrL.cjs

MediumShips Build Helperscripts/download-tools.sh

MediumShips Compressed Blobtools/archives/difftastic-arm64-linux.tar.gz

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings