registry / ggk-happy / 1.2.46

ggk-happy@1.2.46

Mobile and Web client for Claude Code and Codex

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 97 file(s), 1.51 MB of source, external domains: 127.0.0.1, accounts.google.com, api.cluster-fluster.com, api.openai.com, auth.openai.com, claude.ai, console.anthropic.com, developers.google.com, github.com, goo.gle, guguke.ask-ggk.com, happy-api.ask-ggk.com, happy.ask-ggk.com, happy.engineering, minio.ask-ggk.com, oauth2.googleapis.com, registry.npmjs.org, www.apple.com, www.googleapis.com

Source & flagged code

9 flagged

package.jsonView file

Lines 105-127json

105 "dotenv": "^16.6.1",

106 "eslint": "^9",

107 "eslint-config-prettier": "^10",

108 "pkgroll": "^2.14.2",

109 "shx": "^0.3.3",

110 "ts-node": "^10",

111 "tsx": "^4.20.6",

112 "typescript": "5.9.3",

113 "vitest": "^3.2.4"

114 },

115 "publishConfig": {

116 "registry": "https://registry.npmjs.org"

117 },

118 "scripts": {

119 "typecheck": "tsc --noEmit",

120 "build": "shx rm -rf dist && tsc --noEmit && pkgroll",

121 "test": "pnpm run build && vitest run",

122 "cli:install": "node scripts/install-local.cjs",

123 "publish:npm": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/publish-npm.ps1",

124 "publish:npm:dry-run": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/publish-npm.ps1 -DryRun",

125 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L125

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L125

126 }

127}

dist/manager-Cly8xVIR.cjsView file

Lines 1-22javascript

1'use strict';

3var sandboxRuntime = require('@anthropic-ai/sandbox-runtime');

4var os = require('node:os');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/manager-Cly8xVIR.cjsView on unpkg · L2

dist/install-fuOJlF3y.mjsView file

Lines 1-22javascript

1import { l as logger } from './time-CKUSF6Gg.mjs';

2import { existsSync, writeFileSync, chmodSync } from 'fs';

3import { execSync } from 'child_process';

4import { t as trimIdent }

dist/index-DDDsWUvE.cjsView file

Lines 1-26javascript

1'use strict';

3var chalk = require('chalk');

4var persistence = require('./time-DWYIWpP2.cjs');

5var node_crypto = require

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/api-QphcIqbs.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = ggk-happy@1.2.30 matchedIdentity = npm:Z2drLWhhcHB5:1.2.30 similarity = 0.515 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/api-QphcIqbs.cjsView on unpkg

Source & flagged code

9 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code