registry / ggk-happy / 1.2.36

ggk-happy@1.2.36

⚠ Under review

Mobile and Web client for Claude Code and Codex

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 1.46 MB of source, external domains: 127.0.0.1, accounts.google.com, api.cluster-fluster.com, api.openai.com, auth.openai.com, claude.ai, console.anthropic.com, developers.google.com, github.com, goo.gle, guguke.ask-ggk.com, happy-api.ask-ggk.com, happy.ask-ggk.com, happy.engineering, minio.ask-ggk.com, oauth2.googleapis.com, registry.npmjs.org, www.apple.com, www.googleapis.com

Source & flagged code

12 flagged

package.jsonView file

Lines 105-127json

105 "dotenv": "^16.6.1",

106 "eslint": "^9",

107 "eslint-config-prettier": "^10",

108 "pkgroll": "^2.14.2",

109 "shx": "^0.3.3",

110 "ts-node": "^10",

111 "tsx": "^4.20.6",

112 "typescript": "5.9.3",

113 "vitest": "^3.2.4"

114 },

115 "publishConfig": {

116 "registry": "https://registry.npmjs.org"

117 },

118 "scripts": {

119 "typecheck": "tsc --noEmit",

120 "build": "shx rm -rf dist && tsc --noEmit && pkgroll",

121 "test": "pnpm run build && vitest run",

122 "cli:install": "node scripts/install-local.cjs",

123 "publish:npm": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/publish-npm.ps1",

124 "publish:npm:dry-run": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/publish-npm.ps1 -DryRun",

125 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L125

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L125

126 }

127}

bin/happy.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

5import { join, dirname } from 'path';

7// Check if we're already running with the flags

dist/lib.cjsView file

Lines 1-22javascript

1'use strict';

3var persistence = require('./types-fda7Pfnq.cjs');

4require('axios');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib.cjsView on unpkg · L2

5require('chalk');

6require('fs');

dist/index-DR41Hb_1.mjsView file

Lines 1-23javascript

1import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import chalk from 'chalk';

2import os, { homedir } from 'node:os';

3import { randomUUID, randomBytes } from 'node:crypto';

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/index-CaCgkEeP.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = ggk-happy@1.2.30 matchedIdentity = npm:Z2drLWhhcHB5:1.2.30 similarity = 0.879 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index-CaCgkEeP.cjsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/happy.mjsView file

2L3: import { execFileSync } from 'child_process'; L4: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

7// Check if we're already running with the flags L8: const hasNoWarnings = process.execArgv.includes('--no-warnings'); L9: const hasNoDeprecation = process.execArgv.includes('--no-deprecation');

High

Shell

Package source references shell execution.

bin/happy.mjsView on unpkg · L7

dist/lib.cjsView file

2L3: var persistence = require('./types-fda7Pfnq.cjs'); L4: require('axios');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib.cjsView on unpkg · L2

dist/index-DR41Hb_1.mjsView file

3import { randomUUID, randomBytes } from 'node:crypto'; L4: import { l as logger, g as readPersistedSessions, h as persistSession, p as projectPath, f as delay, I as InvalidateSync, R as RawJSONLinesSchema, i as AsyncLock, j as readDaemonSt... L5: import spawn$1, { spawn } from 'cross-spawn'; ... L11: import fs, { watch, access } from 'fs/promises'; L12: import { useStdout, useInput, Box, Text, render } from 'ink'; L13: import React, { useState, useRef, useEffect, useCallback } from 'react'; L14: import { query as query$1, AbortError } from '@anthropic-ai/claude-agent-sdk'; L15: import axios, { AxiosError } from 'axios'; L16: import 'node:events'; ... L19: import os$1, { homedir as homedir$1 } from 'os'; L20: import { spawn as spawn$2, execSync as execSync$1, exec } from 'child_process'; L21: import { createId } from '@paralleldrive/cuid2';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index-DR41Hb_1.mjsView on unpkg · L3

3Cross-file remote execution chain: dist/index-DR41Hb_1.mjs spawns scripts/claude_local_launcher.cjs; helper contains network access plus dynamic code execution. L3: import { randomUUID, randomBytes } from 'node:crypto'; L4: import { l as logger, g as readPersistedSessions, h as persistSession, p as projectPath, f as delay, I as InvalidateSync, R as RawJSONLinesSchema, i as AsyncLock, j as readDaemonSt... L5: import spawn$1, { spawn } from 'cross-spawn'; ... L11: import fs, { watch, access } from 'fs/promises'; L12: import { useStdout, useInput, Box, Text, render } from 'ink'; L13: import React, { useState, useRef, useEffect, useCallback } from 'react'; L14: import { query as query$1, AbortError } from '@anthropic-ai/claude-agent-sdk'; L15: import axios, { AxiosError } from 'axios'; L16: import 'node:events'; ... L19: import os$1, { homedir as homedir$1 } from 'os'; L20: import { spawn as spawn$2, execSync as execSync$1, exec } from 'child_process'; L21: import { createId } from '@paralleldrive/cuid2';

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index-DR41Hb_1.mjsView on unpkg · L3

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index-DR41Hb_1.mjsView on unpkg · L3

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/index-CaCgkEeP.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index-CaCgkEeP.cjsView on unpkg

Findings

1 Critical6 High8 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/index-CaCgkEeP.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/happy.mjs

HighShellbin/happy.mjs

HighSandbox Evasion Gated Capabilitydist/index-DR41Hb_1.mjs

HighCross File Remote Execution Contextdist/index-DR41Hb_1.mjs

HighShips High Entropy Blobtools/archives/difftastic-arm64-linux.tar.gz

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/lib.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index-DR41Hb_1.mjs

MediumShips Build Helperscripts/download-tools.sh

MediumShips Compressed Blobtools/archives/difftastic-arm64-linux.tar.gz

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

12 flagged

package.jsonView file

Lines 105-127json

105 "dotenv": "^16.6.1",

106 "eslint": "^9",

107 "eslint-config-prettier": "^10",

108 "pkgroll": "^2.14.2",

109 "shx": "^0.3.3",

110 "ts-node": "^10",

111 "tsx": "^4.20.6",

112 "typescript": "5.9.3",

113 "vitest": "^3.2.4"

114 },

115 "publishConfig": {

116 "registry": "https://registry.npmjs.org"

117 },

118 "scripts": {

119 "typecheck": "tsc --noEmit",

120 "build": "shx rm -rf dist && tsc --noEmit && pkgroll",

121 "test": "pnpm run build && vitest run",

122 "cli:install": "node scripts/install-local.cjs",

123 "publish:npm": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/publish-npm.ps1",

124 "publish:npm:dry-run": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/publish-npm.ps1 -DryRun",

125 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L125

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L125

126 }

127}

bin/happy.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/happy.mjsView on unpkg · L2

5import { join, dirname } from 'path';

7// Check if we're already running with the flags

dist/lib.cjsView file

Lines 1-22javascript

1'use strict';

3var persistence = require('./types-fda7Pfnq.cjs');

4require('axios');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib.cjsView on unpkg · L2

5require('chalk');

6require('fs');

dist/index-DR41Hb_1.mjsView file

Lines 1-23javascript

1import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import chalk from 'chalk';

2import os, { homedir } from 'node:os';

3import { randomUUID, randomBytes } from 'node:crypto';

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/index-CaCgkEeP.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index-CaCgkEeP.cjsView on unpkg