registry / ggk-happy / 1.2.35

ggk-happy@1.2.35

⚠ Under review

Mobile and Web client for Claude Code and Codex

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 1.46 MB of source, external domains: 127.0.0.1, accounts.google.com, api.cluster-fluster.com, api.openai.com, auth.openai.com, claude.ai, console.anthropic.com, developers.google.com, github.com, goo.gle, guguke.ask-ggk.com, happy-api.ask-ggk.com, happy.ask-ggk.com, happy.engineering, minio.ask-ggk.com, oauth2.googleapis.com, registry.npmjs.org, www.apple.com, www.googleapis.com

Source & flagged code

12 flagged

package.jsonView file

Lines 105-127json

105 "dotenv": "^16.6.1",

106 "eslint": "^9",

107 "eslint-config-prettier": "^10",

108 "pkgroll": "^2.14.2",

109 "shx": "^0.3.3",

110 "ts-node": "^10",

111 "tsx": "^4.20.6",

112 "typescript": "5.9.3",

113 "vitest": "^3.2.4"

114 },

115 "publishConfig": {

116 "registry": "https://registry.npmjs.org"

117 },

118 "scripts": {

119 "typecheck": "tsc --noEmit",

120 "build": "shx rm -rf dist && tsc --noEmit && pkgroll",

121 "test": "pnpm run build && vitest run",

122 "cli:install": "node scripts/install-local.cjs",

123 "publish:npm": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/publish-npm.ps1",

124 "publish:npm:dry-run": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/publish-npm.ps1 -DryRun",

125 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L125

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L125

126 }

127}

bin/happy.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

5import { join, dirname } from 'path';

7// Check if we're already running with the flags

8const hasNoWarnings = process.execArgv.includes('--no-warnings');

9const hasNoDeprecation = process.execArgv.includes('--no-deprecation');

High

Shell

Package source references shell execution.

bin/happy.mjsView on unpkg · L7

11if (!hasNoWarnings || !hasNoDeprecation) {

12 // Get path to the actual CLI entrypoint

13 const projectRoot = dirname(dirname(fileURLToPath(import.meta.url)));

14 const entrypoint = join(projectRoot, 'dist', 'index.mjs');

16 // Execute the actual CLI directly with the correct flags

17 try {

18 execFileSync(process.execPath, [

19 '--no-warnings',

20 '--no-deprecation',

21 entrypoint,

22 ...process.argv.slice(2)

23 ], {

24 stdio: 'inherit',

25 env: process.env

26 });

27 } catch (error) {

dist/lib.cjsView file

Lines 1-22javascript

1'use strict';

3var persistence = require('./types-DaduoF13.cjs');

4require('axios');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib.cjsView on unpkg · L2

5require('chalk');

6require('fs');

7require('node:util');

8require('node:fs');

9require('node:os');

10require('node:path');

11require('node:events');

12require('socket.io-client');

13require('zod');

14require('@slopus/happy-wire');

15require('node:crypto');

16require('tweetnacl');

17require('child_process');

18require('util');

19require('fs/promises');

20require('crypto');

21require('path');

22require('cross-spawn');

dist/index-N0EnBaLx.cjsView file

Lines 1-36javascript

1'use strict';

3var chalk = require('chalk');

4var os = require('node:os');

5var node_crypto = require('node:crypto');

6var persistence = require('./types-DaduoF13.cjs');

7var spawn = require('cross-spawn');

8var path = require('node:path');

9var node_readline = require('node:readline');

10var node_fs = require('node:fs');

11var sandboxRuntime = require('@anthropic-ai/sandbox-runtime');

12var fs$1 = require('node:fs/promises');

13var fs = require('fs/promises');

14var ink = require('ink');

15var React = require('react');

16var claudeAgentSdk = require('@anthropic-ai/claude-agent-sdk');

17var axios = require('axios');

18require('node:events');

19require('socket.io-client');

20var tweetnacl = require('tweetnacl');

21var os$1 = require('os');

22var child_process = require('child_process');

23var cuid2 = require('@paralleldrive/cuid2');

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index-N0EnBaLx.cjsView on unpkg · L16

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index-N0EnBaLx.cjsView on unpkg · L16

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index-N0EnBaLx.cjsView on unpkg · L16

24var happyWire = require('@slopus/happy-wire');

25var fs$2 = require('fs');

26var path$1 = require('path');

27require('expo-server-sdk');

28var node_child_process = require('node:child_process');

29var crypto = require('crypto');

30var psList = require('ps-list');

31var tmp = require('tmp');

32var QRCode = require('qrcode');

33var open = require('open');

34var fastify = require('fastify');

35var z = require('zod');

36var fastifyTypeProviderZod = require('fastify-type-provider-zod');

•matchType = previous_version_dangerous_delta matchedPackage = ggk-happy@1.2.30 matchedIdentity = npm:Z2drLWhhcHB5:1.2.30 similarity = 0.879 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index-N0EnBaLx.cjsView on unpkg

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/happy.mjsView file

2L3: import { execFileSync } from 'child_process'; L4: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

7// Check if we're already running with the flags L8: const hasNoWarnings = process.execArgv.includes('--no-warnings'); L9: const hasNoDeprecation = process.execArgv.includes('--no-deprecation');

High

Shell

Package source references shell execution.

bin/happy.mjsView on unpkg · L7

dist/lib.cjsView file

2L3: var persistence = require('./types-DaduoF13.cjs'); L4: require('axios');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib.cjsView on unpkg · L2

dist/index-N0EnBaLx.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index-N0EnBaLx.cjsView on unpkg

16var claudeAgentSdk = require('@anthropic-ai/claude-agent-sdk'); L17: var axios = require('axios'); L18: require('node:events'); ... L21: var os$1 = require('os'); L22: var child_process = require('child_process'); L23: var cuid2 = require('@paralleldrive/cuid2'); ... L152: ...existing, L153: metadata: { L154: ...existing.metadata, ... L234: const projectId = path.resolve(workingDirectory).replace(/[^a-zA-Z0-9-]/g, "-"); L235: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude"); L236: return path.join(claudeConfigDir, "projects", projectId);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index-N0EnBaLx.cjsView on unpkg · L16

16Cross-file remote execution chain: dist/index-N0EnBaLx.cjs spawns scripts/claude_local_launcher.cjs; helper contains network access plus dynamic code execution. L16: var claudeAgentSdk = require('@anthropic-ai/claude-agent-sdk'); L17: var axios = require('axios'); L18: require('node:events'); ... L21: var os$1 = require('os'); L22: var child_process = require('child_process'); L23: var cuid2 = require('@paralleldrive/cuid2'); ... L152: ...existing, L153: metadata: { L154: ...existing.metadata, ... L234: const projectId = path.resolve(workingDirectory).replace(/[^a-zA-Z0-9-]/g, "-"); L235: const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude"); L236: return path.join(claudeConfigDir, "projects", projectId);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index-N0EnBaLx.cjsView on unpkg · L16

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index-N0EnBaLx.cjsView on unpkg · L16

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

Findings

1 Critical6 High8 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/index-N0EnBaLx.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/happy.mjs

HighShellbin/happy.mjs

HighSandbox Evasion Gated Capabilitydist/index-N0EnBaLx.cjs

HighCross File Remote Execution Contextdist/index-N0EnBaLx.cjs

HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/lib.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index-N0EnBaLx.cjs

MediumShips Build Helperscripts/download-tools.sh

MediumShips Compressed Blobtools/archives/difftastic-arm64-linux.tar.gz

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

12 flagged

package.jsonView file

Lines 105-127json

105 "dotenv": "^16.6.1",

106 "eslint": "^9",

107 "eslint-config-prettier": "^10",

108 "pkgroll": "^2.14.2",

109 "shx": "^0.3.3",

110 "ts-node": "^10",

111 "tsx": "^4.20.6",

112 "typescript": "5.9.3",

113 "vitest": "^3.2.4"

114 },

115 "publishConfig": {

116 "registry": "https://registry.npmjs.org"

117 },

118 "scripts": {

119 "typecheck": "tsc --noEmit",

120 "build": "shx rm -rf dist && tsc --noEmit && pkgroll",

121 "test": "pnpm run build && vitest run",

122 "cli:install": "node scripts/install-local.cjs",

123 "publish:npm": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/publish-npm.ps1",

124 "publish:npm:dry-run": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/publish-npm.ps1 -DryRun",

125 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L125

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L125

126 }

127}

bin/happy.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

5import { join, dirname } from 'path';

7// Check if we're already running with the flags

8const hasNoWarnings = process.execArgv.includes('--no-warnings');

9const hasNoDeprecation = process.execArgv.includes('--no-deprecation');

High

Shell

Package source references shell execution.

bin/happy.mjsView on unpkg · L7

11if (!hasNoWarnings || !hasNoDeprecation) {

12 // Get path to the actual CLI entrypoint

13 const projectRoot = dirname(dirname(fileURLToPath(import.meta.url)));

14 const entrypoint = join(projectRoot, 'dist', 'index.mjs');

16 // Execute the actual CLI directly with the correct flags

17 try {

18 execFileSync(process.execPath, [

19 '--no-warnings',

20 '--no-deprecation',

21 entrypoint,

22 ...process.argv.slice(2)

23 ], {

24 stdio: 'inherit',

25 env: process.env

26 });

27 } catch (error) {

dist/lib.cjsView file

Lines 1-22javascript

1'use strict';

3var persistence = require('./types-DaduoF13.cjs');

4require('axios');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib.cjsView on unpkg · L2

5require('chalk');

6require('fs');

7require('node:util');

8require('node:fs');

9require('node:os');

10require('node:path');

11require('node:events');

12require('socket.io-client');

13require('zod');

14require('@slopus/happy-wire');

15require('node:crypto');

16require('tweetnacl');

17require('child_process');

18require('util');

19require('fs/promises');

20require('crypto');

21require('path');

22require('cross-spawn');

dist/index-N0EnBaLx.cjsView file

Lines 1-36javascript

1'use strict';

3var chalk = require('chalk');

4var os = require('node:os');

5var node_crypto = require('node:crypto');

6var persistence = require('./types-DaduoF13.cjs');

7var spawn = require('cross-spawn');

8var path = require('node:path');

9var node_readline = require('node:readline');

10var node_fs = require('node:fs');

11var sandboxRuntime = require('@anthropic-ai/sandbox-runtime');

12var fs$1 = require('node:fs/promises');

13var fs = require('fs/promises');

14var ink = require('ink');

15var React = require('react');

16var claudeAgentSdk = require('@anthropic-ai/claude-agent-sdk');

17var axios = require('axios');

18require('node:events');

19require('socket.io-client');

20var tweetnacl = require('tweetnacl');

21var os$1 = require('os');

22var child_process = require('child_process');

23var cuid2 = require('@paralleldrive/cuid2');

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index-N0EnBaLx.cjsView on unpkg · L16

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index-N0EnBaLx.cjsView on unpkg · L16

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index-N0EnBaLx.cjsView on unpkg · L16

24var happyWire = require('@slopus/happy-wire');

25var fs$2 = require('fs');

26var path$1 = require('path');

27require('expo-server-sdk');

28var node_child_process = require('node:child_process');

29var crypto = require('crypto');

30var psList = require('ps-list');

31var tmp = require('tmp');

32var QRCode = require('qrcode');

33var open = require('open');

34var fastify = require('fastify');

35var z = require('zod');

36var fastifyTypeProviderZod = require('fastify-type-provider-zod');

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index-N0EnBaLx.cjsView on unpkg

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg