registry / claudeputer / 1.1.58

claudeputer@1.1.58

⚠ Under review

Mobile and Web client for Claude Code and Codex (fork of happy)

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 32 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 40 file(s), 2.35 MB of source, external domains: 127.0.0.1, accounts.google.com, api.anthropic.com, api.cluster-fluster.com, api.deepseek.com, api.meta.ai, api.moonshot.ai, api.openai.com, api.z.ai, app.happy.engineering, auth.openai.com, claude.ai, console.anthropic.com, developers.google.com, github.com, goo.gle, happy.engineering, models.dev, oauth2.googleapis.com, openrouter.ai, registry.npmjs.org, www.apple.com, www.googleapis.com

Source & flagged code

24 flagged

package.jsonView file

Lines 56-96json

56 "bin",

57 "scripts",

58 "tools/archives",

59 "tools/licenses",

60 "package.json"

61 ],

62 "scripts": {

63 "why do we need to build before running tests / dev?": "We need the binary to be built so we run daemon commands which directly run the binary - we don't want them to go out of sync or have custom spawn logic depending how we started happy",

64 "typecheck": "tsc --noEmit",

65 "build": "shx rm -rf dist && tsc --noEmit && pkgroll",

66 "test": "$npm_execpath run test:unit",

67 "test:unit": "$npm_execpath run build && cross-env HAPPY_SKIP_TEST_BUILD=1 vitest run --project unit",

68 "test:integration": "$npm_execpath run build && cross-env HAPPY_SKIP_TEST_BUILD=1 vitest run --project integration-empty --project integration-authenticated",

69 "test:all": "$npm_execpath run build && cross-env HAPPY_SKIP_TEST_BUILD=1 vitest run",

70 "start": "$npm_execpath run build && node ./bin/happy.mjs",

71 "cli": "tsx src/index.ts",

72 "dev": "tsx src/index.ts",

73 "dev:local-server": "$npm_execpath run build && tsx --env-file .env.dev-local-server src/index.ts",

74 "prepublishOnly": "$npm_execpath run test:unit",

75 "release": "npx --no-install release-it",

76 "postinstall": "node scripts/unpack-tools.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L76

77 "// ==== Dev/Stable Variant Management ====": "echo comment",

78 "stable": "node scripts/env-wrapper.cjs stable",

79 "dev:variant": "node scripts/env-wrapper.cjs dev",

80 "// ==== Stable Version Quick Commands ====": "echo comment",

81 "stable:daemon:start": "node scripts/env-wrapper.cjs stable daemon start",

82 "stable:daemon:stop": "node scripts/env-wrapper.cjs stable daemon stop",

83 "stable:daemon:status": "node scripts/env-wrapper.cjs stable daemon status",

84 "stable:auth": "node scripts/env-wrapper.cjs stable auth",

85 "// ==== Development Version Quick Commands ====": "echo comment",

86 "dev:daemon:start": "node scripts/env-wrapper.cjs dev daemon start",

87 "dev:daemon:stop": "node scripts/env-wrapper.cjs dev daemon stop",

88 "dev:daemon:status": "node scripts/env-wrapper.cjs dev daemon status",

89 "dev:auth": "node scripts/env-wrapper.cjs dev auth",

90 "// ==== Setup ====": "echo comment",

91 "setup:dev": "node scripts/setup-dev.cjs",

92 "doctor": "node scripts/env-wrapper.cjs stable doctor",

93 "// ==== Development Linking ====": "echo comment",

94 "link:dev": "node scripts/link-dev.cjs",

95 "unlink:dev": "node scripts/link-dev.cjs unlink"

96 },

bin/happy-dev.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy-dev.mjsView on unpkg · L2

5import { join, dirname } from

dist/types-B5ESKQpj.mjsView file

Lines 1342-1382javascript

1342 });

1343 });

1344 child.on("error", (err) => {

1345 reject(err);

1346 });

1347 });

1348}

1349

dist/lib.cjsView file

Lines 1-22javascript

1'use strict';

3var persistence = require('./types-9a_N063o.cjs');

4require('axios');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib.cjsView on unpkg · L2

5require('chalk');

dist/index-S10XDc-B.mjsView file

3import { randomUUID, randomBytes, createHash as createHash$1 } from 'node:crypto'; L4: import { l as logger, p as projectPath, f as delay$1, I as InvalidateSync, R as RawJSONLinesSchema, g as claudePromptCacheSchema, c as configuration, h as AsyncLock, u as updateCla... L5: import { spawn, execFile, execSync, execFileSync } from 'node:child_process'; L6: import { resolve, join, isAbsolute, dirname, delimiter, sep, basename, relative } from 'node:path'; ... L11: import fs, { watch, access } from 'fs/promises'; L12: import { useStdout, useInput, Box, Text, render } from 'ink'; L13: import React, { useState, useRef, useEffect, useCallback } from 'react'; L14: import { fileURLToPath } from 'node:url'; L15: import axios, { AxiosError } from 'axios'; L16: import 'node:events'; ... L426: cons

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index-S10XDc-B.mjsView on unpkg · L3

dist/index-Cy0HzNla.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = claudeputer@1.1.55 matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.55 similarity = 0.870 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index-Cy0HzNla.cjsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index-Cy0HzNla.cjs: var node_readline = require('node:readline'); this.claudeEnvVars = opts.claudeEnvVars; this.claudeArgs = opts.claudeArgs; this.claudeGoalStatusCallbacks = []; claudePromptCache: metadata.claudeSessionId === sessionId ? metadata.claudePromptCache : void 0 metadata?.claudeSessionId ?? this.sessionId, for (const callback of this.claudeGoalStatusCallbacks) { this.claudeGoalStatusCallbacks.push(callback);

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index-Cy0HzNla.cjsView on unpkg

6Cross-file remote execution chain: dist/index-Cy0HzNla.cjs spawns scripts/claude_local_launcher.cjs; helper contains network access plus dynamic code execution. L6: var persistence = require('./types-9a_N063o.cjs'); L7: var node_child_process = require('node:child_process'); L8: var node_path = require('node:path'); ... L16: var node_url = require('node:url'); L17: var axios = require('axios'); L18: require('node:events'); ... L448: const projectId = node_path.resolve(workingDirectory).replace(/[^a-zA-Z0-9-]/g, "-"); L449: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || node_path.join(os.homedir(), ".claude"); L450: return node_path.join(claudeConfigDir, "projects", projectId); ... L464: try { L465: const parsed = JSON.parse(v); L466: return typeof parsed.uuid === "string" && pars

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/index-CQPiBgQ8.mjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index-CQPiBgQ8.mjsView on unpkg

dist/config-CiWERqgz.cjsView file

•matchType = token_shingles matchedPackage = claudeputer@1.1.41 matchedPath = dist/config-PxyM2qqi.cjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High