Malicious code in ggk-happy (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d747cc7acd8bbc1defbf475aa3202fd332fd43135a6fedddfcc37356ce02eb54) Package presents itself as the legitimate slopus/happy CLI (README instructs `npm install -g happy`; homepage, repository, bugs, and author fields all point at happy.engineering / github.com/slopus/happy), but the published name is ggk-happy and the shipped code has been modified in ways that harm installers: 1. Backend redirection: DEFAULT_SERVER_URL is hardcoded to https://happy-api.ask-ggk.com and DEFAULT_WEBAPP_URL to https://happy.ask-ggk.com — third-party hosts not disclosed in the README, which still references api.cluster-fluster.com. All coding-agent sessions (Claude Code / Codex prompts, source code, auth tokens, machine metadata) flow to ask-ggk.com instead of the publisher advertised in package metadata. 2. Remote-control surface pointed at attacker infrastructure: ApiSessionClient / ApiMachineClient open a socket.io connection to the redirected server and register RPC handlers named `bash`, `readFile`, `writeFile`, `listDirectory`, `getDirectoryTree`, `ripgrep`, `difftastic`. The `bash` handler runs `execAsync(data.command, options)` on parameters supplied by the remote server. Whoever operates happy-api.ask-ggk.com can execute arbitrary shell commands and read/write files on the installer's machine. 3. Install-time auto-takeover: scripts/postinstall.cjs, on global or root install, unconditionally spawns `node bin/happy.mjs install`, running the full auth/registration flow (browser opened to happy.ask-ggk.com, machine registered to happy-api.ask-ggk.com, daemon started) at `npm install -g` time. Auto-takeover is opt-out via env var, not opt-in, so `sudo npm install -g ggk-happy` immediately binds the machine to the third-party backend, with elevated privileges on Linux/macOS root installs. 4. Unpinned binary dropper: RTK_DOWNLOAD_URLS fetches platform-specific `rtk` binaries from https://minio.ask-ggk.com/happy/rtk-*.{zip,tar.gz} (win32/darwin/linux, x64/arm64) with no hash or signature verification, stages them to ~/.local/share/ggkhappy/rtk/bin/rtk (or %LOCALAPPDATA%\ggkhappy\rtk\bin\rtk.exe), and later invokes them via execFile. Purpose of the binary is not documented. 5. Covert identity reporting: readRtkIdentity() reads the installer's machineId from ~/.happy settings and the auth token from ~/.happy/access.key and POSTs them, together with platform/version fields, to https://guguke.ask-ggk.com/api/v1/agent/rtk/gain/report — a side channel to a host not referenced in README documentation. This is not a legitimate fork: the surface identity (name, homepage, repo, README install command) still claims to be slopus/happy, while all backends, the remote-shell RPC destination, the runtime binary source, and the identity reporter have been repointed to ask-ggk.com infrastructure. Installers who follow the README believe they are installing the upstream project and instead grant an undisclosed operator remote code execution over their machine and full visibility into their AI coding sessions.
AI Analysis
Technical Summary
The 'ggk-happy' npm package impersonates the legitimate 'happy' CLI by retaining its name, homepage, and repository metadata while redirecting all backend API and webapp URLs to attacker-controlled domains (happy-api.ask-ggk.com, happy.ask-ggk.com). It establishes a socket.io connection exposing RPC handlers that allow arbitrary shell command execution and file system manipulation. During global or root installation, it automatically initiates an authentication and registration flow binding the machine to the attacker's backend with elevated privileges. The package downloads platform-specific 'rtk' binaries from an unverified source and executes them without integrity checks. Additionally, it exfiltrates machine identifiers and authentication tokens to a covert reporting server (guguke.ask-ggk.com). This is a supply chain attack delivering remote code execution and data exfiltration under the guise of a trusted package.
Potential Impact
Attackers controlling the backend infrastructure can execute arbitrary shell commands with the privileges of the installing user, including root on Linux/macOS if installed globally. They gain full read/write access to the victim's file system and can monitor or manipulate AI coding sessions and authentication tokens. The automatic installation-time takeover means victims are compromised immediately upon installing the package globally. The unsigned binary dropper further expands the attack surface with unknown payloads. Overall, this leads to complete compromise of the victim's machine and sensitive data exposure.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately avoid installing or using the 'ggk-happy' package. Verify package authenticity by checking the exact package name and source repository before installation. Remove any installations of 'ggk-happy' from affected systems and investigate for signs of compromise. Since this is a malicious package impersonating a legitimate tool, rely only on the official 'happy' package from the verified source. Monitor for updates from the legitimate project or npm advisories for further guidance. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.
Malicious code in ggk-happy (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d747cc7acd8bbc1defbf475aa3202fd332fd43135a6fedddfcc37356ce02eb54) Package presents itself as the legitimate slopus/happy CLI (README instructs `npm install -g happy`; homepage, repository, bugs, and author fields all point at happy.engineering / github.com/slopus/happy), but the published name is ggk-happy and the shipped code has been modified in ways that harm installers: 1. Backend redirection: DEFAULT_SERVER_URL is hardcoded to https://happy-api.ask-ggk.com and DEFAULT_WEBAPP_URL to https://happy.ask-ggk.com — third-party hosts not disclosed in the README, which still references api.cluster-fluster.com. All coding-agent sessions (Claude Code / Codex prompts, source code, auth tokens, machine metadata) flow to ask-ggk.com instead of the publisher advertised in package metadata. 2. Remote-control surface pointed at attacker infrastructure: ApiSessionClient / ApiMachineClient open a socket.io connection to the redirected server and register RPC handlers named `bash`, `readFile`, `writeFile`, `listDirectory`, `getDirectoryTree`, `ripgrep`, `difftastic`. The `bash` handler runs `execAsync(data.command, options)` on parameters supplied by the remote server. Whoever operates happy-api.ask-ggk.com can execute arbitrary shell commands and read/write files on the installer's machine. 3. Install-time auto-takeover: scripts/postinstall.cjs, on global or root install, unconditionally spawns `node bin/happy.mjs install`, running the full auth/registration flow (browser opened to happy.ask-ggk.com, machine registered to happy-api.ask-ggk.com, daemon started) at `npm install -g` time. Auto-takeover is opt-out via env var, not opt-in, so `sudo npm install -g ggk-happy` immediately binds the machine to the third-party backend, with elevated privileges on Linux/macOS root installs. 4. Unpinned binary dropper: RTK_DOWNLOAD_URLS fetches platform-specific `rtk` binaries from https://minio.ask-ggk.com/happy/rtk-*.{zip,tar.gz} (win32/darwin/linux, x64/arm64) with no hash or signature verification, stages them to ~/.local/share/ggkhappy/rtk/bin/rtk (or %LOCALAPPDATA%\ggkhappy\rtk\bin\rtk.exe), and later invokes them via execFile. Purpose of the binary is not documented. 5. Covert identity reporting: readRtkIdentity() reads the installer's machineId from ~/.happy settings and the auth token from ~/.happy/access.key and POSTs them, together with platform/version fields, to https://guguke.ask-ggk.com/api/v1/agent/rtk/gain/report — a side channel to a host not referenced in README documentation. This is not a legitimate fork: the surface identity (name, homepage, repo, README install command) still claims to be slopus/happy, while all backends, the remote-shell RPC destination, the runtime binary source, and the identity reporter have been repointed to ask-ggk.com infrastructure. Installers who follow the README believe they are installing the upstream project and instead grant an undisclosed operator remote code execution over their machine and full visibility into their AI coding sessions.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'ggk-happy' npm package impersonates the legitimate 'happy' CLI by retaining its name, homepage, and repository metadata while redirecting all backend API and webapp URLs to attacker-controlled domains (happy-api.ask-ggk.com, happy.ask-ggk.com). It establishes a socket.io connection exposing RPC handlers that allow arbitrary shell command execution and file system manipulation. During global or root installation, it automatically initiates an authentication and registration flow binding the machine to the attacker's backend with elevated privileges. The package downloads platform-specific 'rtk' binaries from an unverified source and executes them without integrity checks. Additionally, it exfiltrates machine identifiers and authentication tokens to a covert reporting server (guguke.ask-ggk.com). This is a supply chain attack delivering remote code execution and data exfiltration under the guise of a trusted package.
Potential Impact
Attackers controlling the backend infrastructure can execute arbitrary shell commands with the privileges of the installing user, including root on Linux/macOS if installed globally. They gain full read/write access to the victim's file system and can monitor or manipulate AI coding sessions and authentication tokens. The automatic installation-time takeover means victims are compromised immediately upon installing the package globally. The unsigned binary dropper further expands the attack surface with unknown payloads. Overall, this leads to complete compromise of the victim's machine and sensitive data exposure.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately avoid installing or using the 'ggk-happy' package. Verify package authenticity by checking the exact package name and source repository before installation. Remove any installations of 'ggk-happy' from affected systems and investigate for signs of compromise. Since this is a malicious package impersonating a legitimate tool, rely only on the official 'happy' package from the verified source. Monitor for updates from the legitimate project or npm advisories for further guidance. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-4789
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a520ecc68715ace438f6410
Added to database: 07/11/2026, 09:37:16 UTC
Last enriched: 07/11/2026, 09:58:49 UTC
Last updated: 07/25/2026, 15:52:32 UTC
Views: 17
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.