registry / claudeputer / 1.1.74

claudeputer@1.1.74

⚠ Under review

Client for managing Claude Code and Codex sessions

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 31 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 40 file(s), 2.41 MB of source, external domains: 127.0.0.1, accounts.google.com, api.anthropic.com, api.cluster-fluster.com, api.deepseek.com, api.meta.ai, api.moonshot.ai, api.openai.com, api.z.ai, app.happy.engineering, auth.openai.com, claude.ai, console.anthropic.com, developers.google.com, github.com, goo.gle, happy.engineering, models.dev, oauth2.googleapis.com, openrouter.ai, registry.npmjs.org, www.apple.com, www.googleapis.com

Source & flagged code

23 flagged

package.jsonView file

Lines 50-90json

50 "bin",

51 "scripts",

52 "tools/archives",

53 "tools/licenses",

54 "package.json"

55 ],

56 "scripts": {

57 "why do we need to build before running tests / dev?": "We need the binary to be built so we run daemon commands which directly run the binary - we don't want them to go out of sync or have custom spawn logic depending how we started happy",

58 "typecheck": "tsc --noEmit",

59 "build": "shx rm -rf dist && tsc --noEmit && pkgroll",

60 "test": "$npm_execpath run test:unit",

61 "test:unit": "$npm_execpath run build && cross-env HAPPY_SKIP_TEST_BUILD=1 vitest run --project unit",

62 "test:integration": "$npm_execpath run build && cross-env HAPPY_SKIP_TEST_BUILD=1 vitest run --project integration-empty --project integration-authenticated",

63 "test:all": "$npm_execpath run build && cross-env HAPPY_SKIP_TEST_BUILD=1 vitest run",

64 "start": "$npm_execpath run build && node ./bin/happy.mjs",

65 "cli": "tsx src/index.ts",

66 "dev": "tsx src/index.ts",

67 "dev:local-server": "$npm_execpath run build && tsx --env-file .env.dev-local-server src/index.ts",

68 "prepublishOnly": "$npm_execpath run test:unit",

69 "release": "npx --no-install release-it",

70 "postinstall": "node scripts/unpack-tools.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L70

71 "// ==== Dev/Stable Variant Management ====": "echo comment",

72 "stable": "node scripts/env-wrapper.cjs stable",

73 "dev:variant": "node scripts/env-wrapper.cjs dev",

74 "// ==== Stable Version Quick Commands ====": "echo comment",

75 "stable:daemon:start": "node scripts/env-wrapper.cjs stable daemon start",

76 "stable:daemon:stop": "node scripts/env-wrapper.cjs stable daemon stop",

77 "stable:daemon:status": "node scripts/env-wrapper.cjs stable daemon status",

78 "stable:auth": "node scripts/env-wrapper.cjs stable auth",

79 "// ==== Development Version Quick Commands ====": "echo comment",

80 "dev:daemon:start": "node scripts/env-wrapper.cjs dev daemon start",

81 "dev:daemon:stop": "node scripts/env-wrapper.cjs dev daemon stop",

82 "dev:daemon:status": "node scripts/env-wrapper.cjs dev daemon status",

83 "dev:auth": "node scripts/env-wrapper.cjs dev auth",

84 "// ==== Setup ====": "echo comment",

85 "setup:dev": "node scripts/setup-dev.cjs",

86 "doctor": "node scripts/env-wrapper.cjs stable doctor",

87 "// ==== Development Linking ====": "echo comment",

88 "link:dev": "node scripts/link-dev.cjs",

89 "unlink:dev": "node scripts/link-dev.cjs unlink"

90 },

bin/happy-dev.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy-dev.mjsView on unpkg · L2

5import { join, dirname } from

dist/index-RURaBZUH.cjsView file

11793L11794: const execAsync = util.promisify(child_process.exec); L11795: const CLIENT_ID = "681255809395-[redacted].apps.googleusercontent.com";

High

Shell

Package source references shell execution.

dist/index-RURaBZUH.cjsView on unpkg · L11793

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index-RURaBZUH.cjs: var node_readline = require('node:readline'); this.claudeEnvVars = opts.claudeEnvVars; this.claudeArgs = opts.claudeArgs; this.claudeGoalStatusCallbacks = []; claudePromptCache: metadata.claudeSessionId === sessionId ? metadata.claudePromptCache : void 0 metadata?.claudeSessionId ?? this.sessionId, for (const callback of this.claudeGoalStatusCallbacks) { this.claudeGoalStatusCallbacks.push(callback);

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index-RURaBZUH.cjsView on unpkg

6Trigger-reachable persistence chain: manifest.main -> dist/index.cjs -> dist/index-RURaBZUH.cjs L6: var persistence = require('./types-Cgjs-VnO.cjs'); L7: var node_child_process = require('node:child_process'); L8: var node_path = require('node:path'); ... L16: var node_url = require('node:url'); L17: var axios = require('axios'); L18: require('node:events'); ... L448: const projectId = node_path.resolve(workingDirectory).replace(/[^a-zA-Z0-9-]/g, "-"); L449: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || node_path.join(os.homedir(), ".claude"); L450: return node_path.join(claudeConfigDir, "projects", projectId); ... L464: try { L465: const parsed = JSON.parse(v); L466: return typeof parsed.uuid === "string" && parsed.uuid.length > 0 || // Claude Code 2.1.x

dist/index-C8tS7JES.cjsView file

Lines 1-22javascript

1'use strict';

3var AcpBackend = require('./AcpBackend-CLhQ2AsE.cjs');

4var persistence = require('./types-Cgjs-VnO.cjs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index-C8tS7JES.cjsView on unpkg · L2

dist/index-Dk5Xo5uH.mjsView file

3Cross-file remote execution chain: dist/index-Dk5Xo5uH.mjs spawns scripts/claude_local_launcher.cjs; helper contains network access plus dynamic code execution. L3: import { randomUUID, randomBytes, createHash as createHash$1 } from 'node:crypto'; L4: import { l as logger, p as projectPath, i as delay$1, I as InvalidateSync, R as RawJSONLinesSchema, j as applySessionTitle, k as claudePromptCacheSchema, n as AsyncLock, s as split... L5: import { spawn, execFile, execSync, execFileSync } from 'node:child_process'; L6: import { resolve, join, isAbsolute, dirname, delimiter, sep, basename, relative } from 'node:path'; ... L11: import fs, { watch, access } from 'fs/promises'; L12: import { useStdout, useInput, Box, Text, render } from 'ink'; L13: import React, { useState, useRef, useEffect, use

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index-Dk5Xo5uH.mjsView on unpkg · L3

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/index-BTGr_exB.mjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index-BTGr_exB.mjsView on unpkg

dist/config-C0wr6Qn3.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = claudeputer@1.1.71 matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.71 similarity = 0.783 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/config-C0wr6Qn3.cjsView on unpkg

•matchType = token_shingles matchedPackage = claudeputer@1.1.41 matchedPath = dist/config-PxyM2qqi.cjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High