ggk-happy
Mobile and Web client for Claude Code and Codex
This report shows the evidence for ggk-happy@1.2.30. 4 of 9 known versions are blocked or flagged. The newest version, 1.2.46, is flagged. See all versions.
OpenSSF/OSV Malicious Advisory
imported 3mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-4789 confirms this npm version as malicious.
Advisory
MAL-2026-4789
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in ggk-happy (npm)
Details
Package presents itself as the legitimate slopus/happy CLI (README instructs `npm install -g happy`; homepage, repository, bugs, and author fields all point at happy.engineering / github.com/slopus/happy), but the published name is ggk-happy and the shipped code has been modified in ways that harm installers:
1. Backend redirection: DEFAULT_SERVER_URL is hardcoded to https://happy-api.ask-ggk.com and DEFAULT_WEBAPP_URL to https://happy.ask-ggk.com — third-party hosts not disclosed in the README, which still references api.cluster-fluster.com. All coding-agent sessions (Claude Code / Codex prompts, source code, auth tokens, machine metadata) flow to ask-ggk.com instead of the publisher advertised in package metadata.
2. Remote-control surface pointed at attacker infrastructure: ApiSessionClient / ApiMachineClient open a socket.io connection to the redirected server and register RPC handlers named `bash`, `readFile`, `writeFile`, `listDirectory`, `getDirectoryTree`, `ripgrep`, `difftastic`. The `bash` handler runs `execAsync(data.command, options)` on parameters supplied by the remote server. Whoever operates happy-api.ask-ggk.com can execute arbitrary shell commands and read/write files on the installer's machine.
3. Install-time auto-takeover: scripts/postinstall.cjs, on global or root install, unconditionally spawns `node bin/happy.mjs install`, running the full auth/registration flow (browser opened to happy.ask-ggk.com, machine registered to happy-api.ask-ggk.com, daemon started) at `npm install -g` time. Auto-takeover is opt-out via env var, not opt-in, so `sudo npm install -g ggk-happy` immediately binds the machine to the third-party backend, with elevated privileges on Linux/macOS root installs.
4. Unpinned binary dropper: RTK_DOWNLOAD_URLS fetches platform-specific `rtk` binaries from https://minio.ask-ggk.com/happy/rtk-*.{zip,tar.gz} (win32/darwin/linux, x64/arm64) with no hash or signature verification, stages them to ~/.local/share/ggkhappy/rtk/bin/rtk (or %LOCALAPPDATA%\ggkhappy\rtk\bin\rtk.exe), and later invokes them via execFile. Purpose of the binary is not documented.
5. Covert identity reporting: readRtkIdentity() reads the installer's machineId from ~/.happy settings and the auth token from ~/.happy/access.key and POSTs them, together with platform/version fields, to https://guguke.ask-ggk.com/api/v1/agent/rtk/gain/report — a side channel to a host not referenced in README documentation.
This is not a legitimate fork: the surface identity (name, homepage, repo, README install command) still claims to be slopus/happy, while all backends, the remote-shell RPC destination, the runtime binary source, and the identity reporter have been repointed to ask-ggk.com infrastructure. Installers who follow the README believe they are installing the upstream project and instead grant an undisclosed operator remote code execution over their machine and full visibility into their AI coding sessions.
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The package has legitimate remote-agent functionality, but the install hook crosses the LPM boundary by performing unconsented lifecycle download/execute/persistence and authenticated telemetry rather than waiting for a user-invoked setup command. This is concrete install-hook abuse, not just noisy scanner output. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm global install or root install runs postinstall
Impact
Unconsented install-time execution of downloaded tooling, shell profile/PATH modification, and authenticated telemetry from an existing Happy identity.
Mechanism
install hook remote binary installation and telemetry
Attack narrative
During global/root npm install, postinstall unpacks tools and invokes the CLI install command. That path downloads a platform RTK binary from minio.ask-ggk.com, copies it into user-local storage, executes rtk init, may add it to PATH or ~/.zshrc, and reports RTK events/gain data to guguke.ask-ggk.com with existing Happy machine/token identity.
AI rationale
The package has legitimate remote-agent functionality, but the install hook crosses the LPM boundary by performing unconsented lifecycle download/execute/persistence and authenticated telemetry rather than waiting for a user-invoked setup command. This is concrete install-hook abuse, not just noisy scanner output. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.
Evidence
package.jsonscripts/postinstall.cjsscripts/unpack-tools.cjsbin/happy.mjsdist/index-BB3s4Iuy.cjs
Independent scan evidence
public snapshotAI called this Suspicious at 92.0% confidence as Malware with medium false-positive risk.
Evidence for AI warning decision
- package.json defines postinstall: node scripts/postinstall.cjs
- scripts/postinstall.cjs auto-runs bin/happy.mjs install on global or root installs unless HAPPY_SKIP_AUTO_TAKEOVER is set
- dist/index-BB3s4Iuy.cjs install path downloads RTK binaries from minio.ask-ggk.com into user paths and executes rtk init
- dist/index-BB3s4Iuy.cjs reports RTK install/gain events to guguke.ask-ggk.com with Happy machineId/token when present
- dist/index-BB3s4Iuy.cjs can append RTK bin path to ~/.zshrc on macOS or user PATH on Windows
Evidence against
- README documents a remote AI agent controller and authentication flows, so network and child_process use are partly package-aligned
- postinstall only auto-takeovers on global/root installs and has HAPPY_SKIP_AUTO_TAKEOVER opt-out
- No static evidence of npm token, SSH key, or arbitrary secret harvesting outside its own Happy credentials/RTK telemetry
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
12 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/happy.mjsView file
2L3: import { execFileSync } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
7// Check if we're already running with the flags
L8: const hasNoWarnings = process.execArgv.includes('--no-warnings');
L9: const hasNoDeprecation = process.execArgv.includes('--no-deprecation');
Findings
1 Critical6 High8 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/index-BB3s4Iuy.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/happy.mjs
HighShellbin/happy.mjs
HighSandbox Evasion Gated Capabilitydist/index-BB3s4Iuy.cjs
HighCross File Remote Execution Contextdist/index-BB3s4Iuy.cjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/AcpBackend-CJDdgla5.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index-BB3s4Iuy.cjs
Affected versions and remediation
This report applies to ggk-happy@1.2.30.
The versions list below shows the verdict for each recorded version.
- Avoid installing ggk-happy@1.2.30. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.