registry / claudeputer / 1.1.64

claudeputer@1.1.64

⚠ Under review

Mobile and Web client for Claude Code and Codex (fork of happy)

AI Security Review

scanned 16d ago · by lpm-firewall-ai

No confirmed attack was established. Install only unpacks archives already shipped in the package. Sending vendor tokens and installing a daemon happen when a person runs the command-line tool.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install runs the unpack script. Token upload and daemon setup run only after a person invokes the matching command.

Impact

Inspected source does not show unsolicited secret theft, a remote payload, or an install-time rewrite of another agent's control files.

Mechanism

The unpack script extracts local archives into the package tools folder. The connect command posts a newly obtained vendor token to the configured Happy server.

AI rationale

Install behavior is limited to unpacking bundled local tools, and credential upload is an explicit connect command to the product server. A clean publication decision cannot be closed because the required citation list is longer than the citation limit, and that limit is not itself evidence of an attack.

Decision evidence

public snapshot

AI called this Manual Review at 62.0% confidence as Unknown with medium false-positive risk.

AI review observations

The only install lifecycle hook is postinstall running scripts/unpack-tools.cjs.
That script extracts the package's own difftastic and ripgrep archives into the package tools directory and marks Unix binaries executable.
Vendor OAuth tokens are posted only after the user runs the connect subcommand, to HAPPY_SERVER_URL or the default Happy server.
Daemon launchd install and Claude hook settings are created when the user starts those CLI flows, not during npm install.
A clean result would need 17 distinct source citations while the review allows at most 8, so a clean decision cannot be finalized.

Evidence against

There is no preinstall hook and no runtime dependency on the package name itself.
Connect help text and the command switch require an explicit vendor subcommand before tokens are sent.
Hook settings are written under the Happy home tmp directory and passed with --settings when launching a session.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 40 file(s), 2.39 MB of source, external domains: 127.0.0.1, accounts.google.com, api.anthropic.com, api.cluster-fluster.com, api.deepseek.com, api.meta.ai, api.moonshot.ai, api.openai.com, api.z.ai, app.happy.engineering, auth.openai.com, claude.ai, console.anthropic.com, developers.google.com, github.com, goo.gle, happy.engineering, models.dev, oauth2.googleapis.com, openrouter.ai, registry.npmjs.org, www.apple.com, www.googleapis.com

Source & flagged code

24 flagged

package.jsonView file

Lines 56-96json

56 "bin",

57 "scripts",

58 "tools/archives",

59 "tools/licenses",

60 "package.json"

61 ],

62 "scripts": {

63 "why do we need to build before running tests / dev?": "We need the binary to be built so we run daemon commands which directly run the binary - we don't want them to go out of sync or have custom spawn logic depending how we started happy",

64 "typecheck": "tsc --noEmit",

65 "build": "shx rm -rf dist && tsc --noEmit && pkgroll",

66 "test": "$npm_execpath run test:unit",

67 "test:unit": "$npm_execpath run build && cross-env HAPPY_SKIP_TEST_BUILD=1 vitest run --project unit",

68 "test:integration": "$npm_execpath run build && cross-env HAPPY_SKIP_TEST_BUILD=1 vitest run --project integration-empty --project integration-authenticated",

69 "test:all": "$npm_execpath run build && cross-env HAPPY_SKIP_TEST_BUILD=1 vitest run",

70 "start": "$npm_execpath run build && node ./bin/happy.mjs",

71 "cli": "tsx src/index.ts",

72 "dev": "tsx src/index.ts",

73 "dev:local-server": "$npm_execpath run build && tsx --env-file .env.dev-local-server src/index.ts",

74 "prepublishOnly": "$npm_execpath run test:unit",

75 "release": "npx --no-install release-it",

76 "postinstall": "node scripts/unpack-tools.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L76

77 "// ==== Dev/Stable Variant Management ====": "echo comment",

78 "stable": "node scripts/env-wrapper.cjs stable",

79 "dev:variant": "node scripts/env-wrapper.cjs dev",

80 "// ==== Stable Version Quick Commands ====": "echo comment",

81 "stable:daemon:start": "node scripts/env-wrapper.cjs stable daemon start",

82 "stable:daemon:stop": "node scripts/env-wrapper.cjs stable daemon stop",

83 "stable:daemon:status": "node scripts/env-wrapper.cjs stable daemon status",

84 "stable:auth": "node scripts/env-wrapper.cjs stable auth",

85 "// ==== Development Version Quick Commands ====": "echo comment",

86 "dev:daemon:start": "node scripts/env-wrapper.cjs dev daemon start",

87 "dev:daemon:stop": "node scripts/env-wrapper.cjs dev daemon stop",

88 "dev:daemon:status": "node scripts/env-wrapper.cjs dev daemon status",

89 "dev:auth": "node scripts/env-wrapper.cjs dev auth",

90 "// ==== Setup ====": "echo comment",

91 "setup:dev": "node scripts/setup-dev.cjs",

92 "doctor": "node scripts/env-wrapper.cjs stable doctor",

93 "// ==== Development Linking ====": "echo comment",

94 "link:dev": "node scripts/link-dev.cjs",

95 "unlink:dev": "node scripts/link-dev.cjs unlink"

96 },

bin/happy-dev.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy-dev.mjsView on unpkg · L2

5import { join, dirname } from

dist/types-Bhi8SeOm.mjsView file

Lines 1342-1382javascript

1342 });

1343 });

1344 child.on("error", (err) => {

1345 reject(err);

1346 });

1347 });

1348}

1349

dist/lib.cjsView file

Lines 1-22javascript

1'use strict';

3var persistence = require('./types-CqwA4Q8T.cjs');

4require('axios');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib.cjsView on unpkg · L2

5require('chalk');

dist/index-D8Mf7sdF.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = claudeputer@1.1.55 matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.55 similarity = 0.848 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index-D8Mf7sdF.cjsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index-D8Mf7sdF.cjs: var node_readline = require('node:readline'); this.claudeEnvVars = opts.claudeEnvVars; this.claudeArgs = opts.claudeArgs; this.claudeGoalStatusCallbacks = []; claudePromptCache: metadata.claudeSessionId === sessionId ? metadata.claudePromptCache : void 0 metadata?.claudeSessionId ?? this.sessionId, for (const callback of this.claudeGoalStatusCallbacks) { this.claudeGoalStatusCallbacks.push(callback);

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index-D8Mf7sdF.cjsView on unpkg

6Cross-file remote execution chain: dist/index-D8Mf7sdF.cjs spawns scripts/claude_local_launcher.cjs; helper contains network access plus dynamic code execution. L6: var persistence = require('./types-CqwA4Q8T.cjs'); L7: var node_child_process = require('node:child_process'); L8: var node_path = require('node:path'); ... L16: var node_url = require('node:url'); L17: var axios = require('axios'); L18: require('node:events'); ... L448: const projectId = node_path.resolve(workingDirectory).replace(/[^a-zA-Z0-9-]/g, "-"); L449: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || node_path.join(os.homedir(), ".claude"); L450: return node_path.join(claudeConfigDir, "projects", projectId); ... L464: try { L465: const parsed = JSON.parse(v); L466: return typeof parsed.uuid === "string" && pars

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/index-CBBFghWu.mjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index-CBBFghWu.mjsView on unpkg

dist/config-BB8TfGZy.cjsView file

•matchType = token_shingles matchedPackage = claudeputer@1.1.41 matchedPath = dist/config-PxyM2qqi.cjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-BB8TfGZy.cjsView on unpkg

dist/runGemini-BqWay7EY.cjsView file

•matchType = token_shingles matchedPackage = claudeputer@1.1.41 matchedPath = dist/runGemini-DFaFvFE0.cjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runGemini-BqWay7EY.cjsView on unpkg

scripts/env-wrapper.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = scripts/env-wrapper.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/env-wrapper.cjsView on unpkg

dist/config-D95UJBh6.mjsView file

•matchType = token_shingles matchedPackage = claudeputer@1.1.41 matchedPath = dist/config-lCTXWyPR.mjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-D95UJBh6.mjsView on unpkg

dist/index.cjsView file

•matchType = token_shingles matchedPackage = claudeputer@1.1.41 matchedPath = dist/index.cjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 1.000 shingleOverlap = 40 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.cjsView on unpkg

dist/runOpenClaw-Cqtqbd9m.cjsView file

•matchType = token_shingles matchedPackage = claudeputer@1.1.41 matchedPath = dist/runOpenClaw-BriywXHV.cjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runOpenClaw-Cqtqbd9m.cjsView on unpkg

scripts/statusline_forwarder.cjsView file

•matchType = normalized_sha256 matchedPackage = claudeputer@1.1.41 matchedPath = scripts/statusline_forwarder.cjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/statusline_forwarder.cjsView on unpkg

scripts/claude_local_launcher.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = scripts/claude_local_launcher.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/claude_local_launcher.cjsView on unpkg

dist/index.mjsView file

•matchType = token_shingles matchedPackage = claudeputer@1.1.41 matchedPath = dist/index.mjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 1.000 shingleOverlap = 40 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.mjsView on unpkg

dist/lib.mjsView file

•matchType = normalized_sha256 matchedPackage = claudeputer@1.1.41 matchedPath = dist/lib.mjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.mjsView on unpkg

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/unpack-tools.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/happy-dev.mjsView file

2L3: import { execFileSync } from 'child_process'; L4: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy-dev.mjsView on unpkg · L2

dist/types-Bhi8SeOm.mjsView file

1362L1363: const execAsync = promisify(exec); L1364: function registerCommonHandlers(rpcHandlerManager, workingDirectory) {

High

Shell

Package source references shell execution.

dist/types-Bhi8SeOm.mjsView on unpkg · L1362

dist/lib.cjsView file

•matchType = normalized_sha256 matchedPackage = claudeputer@1.1.41 matchedPath = dist/lib.cjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.cjsView on unpkg

2L3: var persistence = require('./types-CqwA4Q8T.cjs'); L4: require('axios');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib.cjsView on unpkg · L2

dist/index-D8Mf7sdF.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index-D8Mf7sdF.cjsView on unpkg

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index-D8Mf7sdF.cjsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index-D8Mf7sdF.cjsView on unpkg · L6

6Trigger-reachable persistence chain: manifest.main -> dist/index.cjs -> dist/index-D8Mf7sdF.cjs L6: var persistence = require('./types-CqwA4Q8T.cjs'); L7: var node_child_process = require('node:child_process'); L8: var node_path = require('node:path'); ... L16: var node_url = require('node:url'); L17: var axios = require('axios'); L18: require('node:events'); ... L448: const projectId = node_path.resolve(workingDirectory).replace(/[^a-zA-Z0-9-]/g, "-"); L449: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || node_path.join(os.homedir(), ".claude"); L450: return node_path.join(claudeConfigDir, "projects", projectId); ... L464: try { L465: const parsed = JSON.parse(v); L466: return typeof parsed.uuid === "string" && parsed.uuid.length > 0 || // Claude Code 2.1.x

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/index-D8Mf7sdF.cjsView on unpkg · L6

6var persistence = require('./types-CqwA4Q8T.cjs'); L7: var node_child_process = require('node:child_process'); L8: var node_path = require('node:path'); ... L16: var node_url = require('node:url'); L17: var axios = require('axios'); L18: require('node:events'); ... L448: const projectId = node_path.resolve(workingDirectory).replace(/[^a-zA-Z0-9-]/g, "-"); L449: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || node_path.join(os.homedir(), ".claude"); L450: return node_path.join(claudeConfigDir, "projects", projectId); ... L464: try { L465: const parsed = JSON.parse(v); L466: return typeof parsed.uuid === "string" && parsed.uuid.length > 0 || // Claude Code 2.1.x

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index-D8Mf7sdF.cjsView on unpkg · L6

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/index-CBBFghWu.mjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index-CBBFghWu.mjsView on unpkg

dist/config-BB8TfGZy.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-BB8TfGZy.cjsView on unpkg

dist/runGemini-BqWay7EY.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runGemini-BqWay7EY.cjsView on unpkg

scripts/env-wrapper.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/env-wrapper.cjsView on unpkg

dist/config-D95UJBh6.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-D95UJBh6.mjsView on unpkg

dist/index.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.cjsView on unpkg

dist/runOpenClaw-Cqtqbd9m.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runOpenClaw-Cqtqbd9m.cjsView on unpkg

scripts/statusline_forwarder.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/statusline_forwarder.cjsView on unpkg

scripts/claude_local_launcher.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/claude_local_launcher.cjsView on unpkg

dist/index.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.mjsView on unpkg

dist/lib.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.mjsView on unpkg

Findings

1 Critical19 High7 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/index-D8Mf7sdF.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/happy-dev.mjs

HighShelldist/types-Bhi8SeOm.mjs

HighCredential Redirect Persistencedist/index-D8Mf7sdF.cjs

HighCross File Remote Execution Contextdist/index-D8Mf7sdF.cjs

HighTrigger Reachable Persistencedist/index-D8Mf7sdF.cjs

HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz

HighSemantic Analysis Limiteddist/index-CBBFghWu.mjs

HighKnown Malware Source Similaritydist/config-BB8TfGZy.cjs

HighKnown Malware Source Similaritydist/runGemini-BqWay7EY.cjs

HighKnown Malware Source Similarityscripts/env-wrapper.cjs

HighKnown Malware Source Similaritydist/config-D95UJBh6.mjs

HighKnown Malware Source Similaritydist/index.cjs

HighKnown Malware Source Similaritydist/lib.cjs

HighKnown Malware Source Similaritydist/runOpenClaw-Cqtqbd9m.cjs

HighKnown Malware Source Similarityscripts/statusline_forwarder.cjs

HighKnown Malware Source Similarityscripts/claude_local_launcher.cjs

HighKnown Malware Source Similaritydist/index.mjs

HighKnown Malware Source Similaritydist/lib.mjs

MediumDynamic Requiredist/lib.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index-D8Mf7sdF.cjs

MediumShips Build Helperscripts/download-tools.sh

MediumShips Compressed Blobtools/archives/difftastic-arm64-linux.tar.gz

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to claudeputer@1.1.64.

See version security history for other recorded verdicts.

Review the evidence and your use of claudeputer@1.1.64 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-22 21:11:54.006Z (UTC).