AI Security Review
scanned 4d ago · by lpm-firewall-aiLPM blocks this version under the AI-agent control-surface policy. Global or root installation triggers automatic setup that downloads and executes a remote rtk binary and initializes hooks. It also reports rtk telemetry using stored Happy identity data.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm global install or root install running postinstall
Impact
Unconsented install-time mutation of local agent/control tooling, PATH modification, and authenticated telemetry/reporting to package-controlled services.
Mechanism
install hook downloads/executes remote binary and initializes agent hook tooling
Policy narrative
On install, the lifecycle script unpacks bundled tools and, for global/root installs, spawns the CLI install command. That path downloads an rtk executable from minio.ask-ggk.com, installs it under a user-local rtk directory, runs rtk init, may modify PATH, and reports install/gain events to guguke.ask-ggk.com with local Happy identity fields. This is install-time control-surface mutation and remote binary execution without being limited to explicit user CLI invocation.
Rationale
The confirmed postinstall behavior goes beyond benign package setup by downloading and executing a remote binary and initializing hooks during install in privileged/global contexts. The package purpose explains remote agent features, but not the unconsented lifecycle takeover path. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.
Evidence
package.jsonscripts/postinstall.cjsbin/happy.mjsscripts/unpack-tools.cjsdist/index-Dh0_cXX6.mjsdist/types-CwF-H6dv.mjstools/unpacked~/.local/share/ggkhappy/rtk/bin/rtk%LOCALAPPDATA%/ggkhappy/rtk/bin/rtk.exe~/.zshrc~/.happy/settings.json~/.happy/access.key
Network endpoints7
minio.ask-ggk.com/happy/rtk-x86_64-pc-windows-msvc.zipminio.ask-ggk.com/happy/rtk-x86_64-apple-darwin.tar.gzminio.ask-ggk.com/happy/rtk-x86_64-unknown-linux-musl.tar.gzminio.ask-ggk.com/happy/rtk-aarch64-unknown-linux-gnu.tar.gzguguke.ask-ggk.com/api/v1/agent/rtk/gain/reporthappy-api.ask-ggk.comhappy.ask-ggk.com
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for policy block
- package.json defines postinstall: node scripts/postinstall.cjs
- scripts/postinstall.cjs auto-runs bin/happy.mjs install on global or root installs unless HAPPY_SKIP_AUTO_TAKEOVER is set
- dist/index-Dh0_cXX6.mjs install downloads rtk binaries from minio.ask-ggk.com and executes rtk init
- dist/index-Dh0_cXX6.mjs reports rtk events/gain data with machineId and token to guguke.ask-ggk.com
- dist/index-Dh0_cXX6.mjs can append rtk bin dir to user PATH via ~/.zshrc on darwin
- dist/index-Dh0_cXX6.mjs registers remote/mobile-driven agent controls including bash/readFile/writeFile handlers scoped to workingDirectory
Evidence against
- Binaries for ripgrep/difftastic are unpacked from bundled archives and appear package-aligned developer tooling
- Primary CLI purpose is declared as mobile/web client for Claude Code and Codex
- Postinstall auto takeover is gated to global/root installs and has HAPPY_SKIP_AUTO_TAKEOVER opt-out
- Remote shell/file handlers validate paths against the session working directory
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/happy.mjsView file
2L3: import { execFileSync } from 'child_process';
L4: import { fileURLToPath } from 'url';
High
7// Check if we're already running with the flags
L8: const hasNoWarnings = process.execArgv.includes('--no-warnings');
L9: const hasNoDeprecation = process.execArgv.includes('--no-deprecation');
High
dist/types-B4Tju8Da.cjsView file
2L3: var axios = require('axios');
L4: var chalk = require('chalk');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/types-B4Tju8Da.cjsView on unpkg · L2dist/index-Dh0_cXX6.mjsView file
3import { randomUUID, randomBytes } from 'node:crypto';
L4: import { l as logger, g as readPersistedSessions, h as persistSession, p as projectPath, f as delay, I as InvalidateSync, R as RawJSONLinesSchema, i as AsyncLock, j as readDaemonSt...
L5: import spawn$1, { spawn } from 'cross-spawn';
...
L11: import fs, { watch, access } from 'fs/promises';
L12: import { useStdout, useInput, Box, Text, render } from 'ink';
L13: import React, { useState, useRef, useEffect, useCallback } from 'react';
L14: import { query as query$1, AbortError } from '@anthropic-ai/claude-agent-sdk';
L15: import axios, { AxiosError } from 'axios';
L16: import 'node:events';
...
L19: import os, { homedir as homedir$1 } from 'os';
L20: import { spawn as spawn$2, execSync as execSync$1, exec } from 'child_process';
L21: import { createId } from '@paralleldrive/cuid2';
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index-Dh0_cXX6.mjsView on unpkg · L33Cross-file remote execution chain: dist/index-Dh0_cXX6.mjs spawns scripts/claude_local_launcher.cjs; helper contains network access plus dynamic code execution.
L3: import { randomUUID, randomBytes } from 'node:crypto';
L4: import { l as logger, g as readPersistedSessions, h as persistSession, p as projectPath, f as delay, I as InvalidateSync, R as RawJSONLinesSchema, i as AsyncLock, j as readDaemonSt...
L5: import spawn$1, { spawn } from 'cross-spawn';
...
L11: import fs, { watch, access } from 'fs/promises';
L12: import { useStdout, useInput, Box, Text, render } from 'ink';
L13: import React, { useState, useRef, useEffect, useCallback } from 'react';
L14: import { query as query$1, AbortError } from '@anthropic-ai/claude-agent-sdk';
L15: import axios, { AxiosError } from 'axios';
L16: import 'node:events';
...
L19: import os, { homedir as homedir$1 } from 'os';
L20: import { spawn as spawn$2, execSync as execSync$1, exec } from 'child_process';
L21: import { createId } from '@paralleldrive/cuid2';
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index-Dh0_cXX6.mjsView on unpkg · L33import { randomUUID, randomBytes } from 'node:crypto';
L4: import { l as logger, g as readPersistedSessions, h as persistSession, p as projectPath, f as delay, I as InvalidateSync, R as RawJSONLinesSchema, i as AsyncLock, j as readDaemonSt...
L5: import spawn$1, { spawn } from 'cross-spawn';
...
L11: import fs, { watch, access } from 'fs/promises';
L12: import { useStdout, useInput, Box, Text, render } from 'ink';
L13: import React, { useState, useRef, useEffect, useCallback } from 'react';
L14: import { query as query$1, AbortError } from '@anthropic-ai/claude-agent-sdk';
L15: import axios, { AxiosError } from 'axios';
L16: import 'node:events';
...
L19: import os, { homedir as homedir$1 } from 'os';
L20: import { spawn as spawn$2, execSync as execSync$1, exec } from 'child_process';
L21: import { createId } from '@paralleldrive/cuid2';
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/index-Dh0_cXX6.mjsView on unpkg · L3scripts/download-tools.shView file
•path = scripts/download-tools.sh
kind = build_helper
sizeBytes = 4241
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
scripts/download-tools.shView on unpkgtools/archives/difftastic-arm64-linux.tar.gzView file
•path = tools/archives/difftastic-arm64-linux.tar.gz
kind = high_entropy_blob
sizeBytes = 11425536
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
tools/archives/difftastic-arm64-linux.tar.gzView on unpkg•path = tools/archives/difftastic-arm64-linux.tar.gz
kind = compressed_blob
sizeBytes = 11425536
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
tools/archives/difftastic-arm64-linux.tar.gzView on unpkgdist/index-AukNP3Zj.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = ggk-happy@1.2.28
matchedIdentity = npm:Z2drLWhhcHB5:1.2.28
similarity = 0.939
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version.
dist/index-AukNP3Zj.cjsView on unpkgFindings
1 Critical6 High8 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/index-AukNP3Zj.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/happy.mjs
HighShellbin/happy.mjs
HighSandbox Evasion Gated Capabilitydist/index-Dh0_cXX6.mjs
HighCross File Remote Execution Contextdist/index-Dh0_cXX6.mjs
HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/types-B4Tju8Da.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index-Dh0_cXX6.mjs
MediumShips Build Helperscripts/download-tools.sh
MediumShips Compressed Blobtools/archives/difftastic-arm64-linux.tar.gz
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings