@factiii/runner@0.15.0

Factiii Runner, run Board AI agents on a machine you control. Pairs with the Factiii web/mobile clients over WebRTC.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is not malicious under the install-hook policy because there is no consumer lifecycle hook and the extension setup follows user invocation of the runner. It warrants a warning because it persistently alters AI-agent integrations and contains a high-privilege agent-launch option.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user runs the Factiii runner and its space setup completes.

Impact

The package extends both AI-agent CLIs and modifies Claude onboarding state; the runner also contains an approval-bypass launch mode.

Mechanism

User-scope AI-agent plugin installation with lifecycle command hooks.

AI rationale

Evidence

dist/cli.jsplugin/factiii/hooks/hooks.jsonplugin/factiii/bin/report-state.sh

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

When the runner sets up a space, it installs its Factiii plugin into both Claude and Codex user scopes.
The bundled plugin registers command hooks for agent prompt, stop, permission, notification, and session-end events.
The hook is designed to run across Claude and Codex sessions and writes agent state to a local Redis socket.
Runner code can mark Claude onboarding complete and can invoke Codex with approvals and sandboxing bypassed in a non-auto mode.

Evidence against

package.json has no preinstall, install, or postinstall hook; prepublishOnly is not run for consumers.
The plugin and hook are first-party Factiii components installed only after the user runs the runner's setup flow.
The inspected hook only reports a state string over a local Unix socket; no credential harvesting or external exfiltration was confirmed.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Source & flagged code

14 flagged

dist/cli.jsView file

38* Constructs the CommanderError class L39: * @param {number} exitCode suggested exit code which could be used with process.exit L40: * @param {string} code an id string representing the error ... L964: var EventEmitter = require("node:events").EventEmitter; L965: var childProcess = require("node:child_process"); L966: var path23 = require("node:path"); ... L1013: this._outputConfiguration = { L1014: writeOut: (str) => process3.stdout.write(str), L1015: writeErr: (str) => process3.stderr.write(str), ... L1049: * @returns {Command[]} L1050: * @private L1051: */

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L38

38Trigger-reachable chain: scripts.start -> dist/cli.js L38: * Constructs the CommanderError class L39: * @param {number} exitCode suggested exit code which could be used with process.exit L40: * @param {string} code an id string representing the error ... L964: var EventEmitter = require("node:events").EventEmitter; L965: var childProcess = require("node:child_process"); L966: var path23 = require("node:path"); ... L1013: this._outputConfiguration = { L1014: writeOut: (str) => process3.stdout.write(str), L1015: writeErr: (str) => process3.stderr.write(str), ... L1049: * @returns {Command[]} L1050: * @private L1051: */

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L38

964var EventEmitter = require("node:events").EventEmitter; L965: var childProcess = require("node:child_process"); L966: var path23 = require("node:path");

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L964

32386var RETRY_MAX_MS = 15e3; L32387: var dynamicImport = new Function("s", "return import(s)"); L32388: var importFs = new Function("s", "return import(s)");

High

Eval

Package source references dynamic code evaluation.

dist/cli.jsView on unpkg · L32386

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: headers["Authorization"] = "Basic " + authBuf.toString("base64"); fs15.writeFileSync(syncFile, "", "utf8"); var execString = "var http = require('http'), https = require('https'), fs = require('fs');var doRequest = http" + (ssl ? "s" : "") + ".request;var options = " + JSON.stringify(opt... delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64"); content: `Claude ${e.claude_code_version ?? ""} (${e.model ?? "unknown"})` "- Persistent agent memory in your state dir (~/.claude or ~/.codex) that survives across s

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

38Cross-file remote execution chain: dist/cli.js spawns index/index.js; helper contains network access plus dynamic code execution. L38: * Constructs the CommanderError class L39: * @param {number} exitCode suggested exit code which could be used with process.exit L40: * @param {string} code an id string representing the error ... L964: var EventEmitter = require("node:events").EventEmitter; L965: var childProcess = require("node:child_process"); L966: var path23 = require("node:path"); ... L1013: this._outputConfiguration = { L1014: writeOut: (str) => process3.stdout.write(str), L1015: writeErr: (str) => process3.stderr.write(str), ... L1049: * @returns {Command[]} L1050: * @private L1051: */

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L38

38Trigger-reachable credential exfiltration chain: scripts.start -> dist/cli.js L38: * Constructs the CommanderError class L39: * @param {number} exitCode suggested exit code which could be used with process.exit L40: * @param {string} code an id string representing the error ... L964: var EventEmitter = require("node:events").EventEmitter; L965: var childProcess = require("node:child_process"); L966: var path23 = require("node:path"); ... L1013: this._outputConfiguration = { L1014: writeOut: (str) => process3.stdout.write(str), L1015: writeErr: (str) => process3.stderr.write(str), ... L1049: * @returns {Command[]} L1050: * @private L1051: */

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/cli.jsView on unpkg · L38

27627patternName = generic_password severity = medium line = 27627

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli.jsView on unpkg · L27627

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L38

vendor/frpc-linux-amd64View file

•path = vendor/frpc-linux-amd64 kind = native_binary sizeBytes = 16453816 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/frpc-linux-amd64View on unpkg

plugin/factiii/bin/report-state.shView file

•path = plugin/factiii/bin/report-state.sh kind = build_helper sizeBytes = 1931 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugin/factiii/bin/report-state.shView on unpkg

index/index.jsView file

•path = index/index.js kind = oversized_source_file sizeBytes = 4639461 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

index/index.jsView on unpkg

vendor/tmux-resurrect/scripts/save.shView file

•matchType = previous_version_dangerous_delta matchedPackage = @factiii/runner@0.14.1 matchedIdentity = npm:QGZhY3RpaWkvcnVubmVy:0.14.1 similarity = 0.846 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

vendor/tmux-resurrect/scripts/save.shView on unpkg

•matchType = normalized_sha256 matchedPackage = @ayorcodes/claudespace@0.9.0 matchedPath = libexec/claudespace.dist/claudespace/assets/tmux-plugins/resurrect/scripts/save.sh matchedIdentity = npm:QGF5b3Jjb2Rlcy9jbGF1ZGVzcGFjZQ:0.9.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

vendor/tmux-resurrect/scripts/save.shView on unpkg

Source & flagged code

14 flagged · loading source

dist/cli.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L38

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L38

Findings

3 Critical6 High8 Medium6 Low

CriticalCredential Exfiltrationdist/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli.js

CriticalPrevious Version Dangerous Deltavendor/tmux-resurrect/scripts/save.sh

HighChild Processdist/cli.js

HighEvaldist/cli.js

HighCredential Redirect Persistencedist/cli.js

HighCross File Remote Execution Contextdist/cli.js

HighTrigger Reachable Credential Exfiltrationdist/cli.js

HighKnown Malware Source Similarityvendor/tmux-resurrect/scripts/save.sh

MediumSecret Patterndist/cli.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to @factiii/runner@0.15.0.

See all versions of @factiii/runner for other recorded verdicts.

Review the evidence and your use of @factiii/runner@0.15.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 04:27:11.779Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.