@factiii/runner@0.9.7

Factiii Runner, run Board AI agents on a machine you control. Pairs with the Factiii web/mobile clients over WebRTC.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Source confirms a high-impact, paired remote-agent capability and user-scoped AI-agent configuration changes. It has no npm install hook and no confirmed covert credential exfiltration or foreign broad control-surface mutation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs setup/connect/start and pairs the runner with Factiii.

Impact

A paired service can invoke powerful local AI tooling and alter its MCP configuration; this is a material agent-extension capability.

Mechanism

Paired remote-agent daemon with user-scoped MCP provisioning and optional port tunneling.

AI rationale

Evidence

package.jsondist/cli.jsREADME.md~/.factiii-runner/~/.claude/~/.codex/

Network endpoints2

api.factiii.comdev.factiii.com

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Runtime provisioning changes user-scoped Claude and Codex MCP configuration.
The paired daemon can launch Codex with bypassed approvals/sandbox when a non-auto mode is selected.
It installs and runs a vendored frpc tunnel harness under its own runner directory.

Evidence against

package.json has no preinstall, install, or postinstall hook.
Activation requires explicit setup/connect/start commands and a pairing token.
MCP endpoints are a per-space localhost service or the configured Factiii server; no covert credential receiver was confirmed.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 1 file(s), 1.02 MB of source, external domains: 127.0.0.1, api.factiii.com, api.github.com, developer.mozilla.org, github.com, graph.microsoft.com, host.docker.internal, login.microsoftonline.com, raw.githubusercontent.com, socket.io, stackoverflow.com

Source & flagged code

16 flagged

dist/cli.jsView file

38Source sends the broad process environment to a literal external destination. L38: * Constructs the CommanderError class L39: * @param {number} exitCode suggested exit code which could be used with process.exit L40: * @param {string} code an id string representing the error ... L964: var EventEmitter = require("node:events").EventEmitter; L965: var childProcess = require("node:child_process"); L966: var path16 = require("node:path"); ... L1013: this._outputConfiguration = { L1014: writeOut: (str) => process2.stdout.write(str), L1015: writeErr: (str) => process2.stderr.write(str), ... L1049: * @returns {Command[]} L1050: * @private L1051: */

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L38

38* Constructs the CommanderError class L39: * @param {number} exitCode suggested exit code which could be used with process.exit L40: * @param {string} code an id string representing the error ... L964: var EventEmitter = require("node:events").EventEmitter; L965: var childProcess = require("node:child_process"); L966: var path16 = require("node:path"); ... L1013: this._outputConfiguration = { L1014: writeOut: (str) => process2.stdout.write(str), L1015: writeErr: (str) => process2.stderr.write(str), ... L1049: * @returns {Command[]} L1050: * @private L1051: */

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L38

38Trigger-reachable chain: scripts.start -> dist/cli.js L38: * Constructs the CommanderError class L39: * @param {number} exitCode suggested exit code which could be used with process.exit L40: * @param {string} code an id string representing the error ... L964: var EventEmitter = require("node:events").EventEmitter; L965: var childProcess = require("node:child_process"); L966: var path16 = require("node:path"); ... L1013: this._outputConfiguration = { L1014: writeOut: (str) => process2.stdout.write(str), L1015: writeErr: (str) => process2.stderr.write(str), ... L1049: * @returns {Command[]} L1050: * @private L1051: */

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L38

964var EventEmitter = require("node:events").EventEmitter; L965: var childProcess = require("node:child_process"); L966: var path16 = require("node:path");

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L964

14626var SELF_WRITE_MS = 2e3; L14627: var dynamicImport = new Function("s", "return import(s)"); L14628: var loadSubscribe = null;

High

Eval

Package source references dynamic code evaluation.

dist/cli.jsView on unpkg · L14626

13231var import_promises = __toESM(require("fs/promises")); L13232: var import_net = __toESM(require("net")); L13233: var import_path3 = __toESM(require("path")); ... L13236: // ../../shared/all/helpers/board-agent-core/host-env.ts L13237: var import_child_process = require("child_process"); L13238: var import_os = __toESM(require("os")); ... L13246: function addBinDirs(dirs) { L13247: const current = (process.env.PATH ?? "").split(import_path2.default.delimiter).filter(Boolean); L13248: const missing = dirs.filter((dir) => dir && !current.includes(dir));

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L13231

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: headers["Authorization"] = "Basic " + authBuf.toString("base64"); fs13.writeFileSync(syncFile, "", "utf8"); var execString = "var http = require('http'), https = require('https'), fs = require('fs');var doRequest = http" + (ssl ? "s" : "") + ".request;var options = " + JSON.stringify(opt... delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64"); content: `Claude ${e.claude_code_version ?? ""} (${e.model ?? "unknown"})` "- Persistent agent memory in your state dir (~/.claude or ~/.codex) that survives across s

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/cli.js: // node_modules/commander/lib/error.js "node_modules/commander/lib/error.js"(exports2) { // node_modules/commander/lib/argument.js "node_modules/commander/lib/argument.js"(exports2) { // node_modules/commander/lib/help.js "node_modules/commander/lib/help.js"(exports2) { // node_modules/commander/lib/option.js "node_modules/commander/lib/option.js"(exports2) {

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/cli.jsView on unpkg

38Cross-file remote execution chain: dist/cli.js spawns index/index.js; helper contains network access plus dynamic code execution. L38: * Constructs the CommanderError class L39: * @param {number} exitCode suggested exit code which could be used with process.exit L40: * @param {string} code an id string representing the error ... L964: var EventEmitter = require("node:events").EventEmitter; L965: var childProcess = require("node:child_process"); L966: var path16 = require("node:path"); ... L1013: this._outputConfiguration = { L1014: writeOut: (str) => process2.stdout.write(str), L1015: writeErr: (str) => process2.stderr.write(str), ... L1049: * @returns {Command[]} L1050: * @private L1051: */

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L38

38Trigger-reachable credential exfiltration chain: scripts.start -> dist/cli.js L38: * Constructs the CommanderError class L39: * @param {number} exitCode suggested exit code which could be used with process.exit L40: * @param {string} code an id string representing the error ... L964: var EventEmitter = require("node:events").EventEmitter; L965: var childProcess = require("node:child_process"); L966: var path16 = require("node:path"); ... L1013: this._outputConfiguration = { L1014: writeOut: (str) => process2.stdout.write(str), L1015: writeErr: (str) => process2.stderr.write(str), ... L1049: * @returns {Command[]} L1050: * @private L1051: */

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/cli.jsView on unpkg · L38

12945patternName = generic_password severity = medium line = 12945 matchedText = url2.pas...ic";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli.jsView on unpkg · L12945

8var __hasOwnProp = Object.prototype.hasOwnProperty; L9: var __commonJS = (cb, mod) => function __require() { L10: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L8

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L38

index/index.jsView file

41664if (e) return e.href; L41665: F(`Invalid absolute docBaseUrl: "${t}".`); L41666: } ... L87787: * L87788: * This can be used by clients to improve the LLM's understanding of available tools, resources, etc. It can be thought of like a "hint" to the model. For example, this information ... L87789: */

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

index/index.jsView on unpkg · L41664

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index/index.jsView on unpkg

vendor/frpc-linux-amd64View file

•path = vendor/frpc-linux-amd64 kind = native_binary sizeBytes = 16453816 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/frpc-linux-amd64View on unpkg

Source & flagged code

16 flagged · loading source

dist/cli.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L38

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L38

Findings

3 Critical9 High7 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationdist/cli.js

CriticalCredential Exfiltrationdist/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli.js

HighChild Processdist/cli.js

HighEvaldist/cli.js

HighSame File Env Network Executiondist/cli.js

HighCredential Redirect Persistencedist/cli.js

HighEntrypoint Foreign Package Code Overwritedist/cli.js

HighRemote Agent Bridgeindex/index.js

HighCross File Remote Execution Contextdist/cli.js

HighTrigger Reachable Credential Exfiltrationdist/cli.js

HighSemantic Analysis Limited

Affected versions and remediation

This report applies to @factiii/runner@0.9.7.

See all versions of @factiii/runner for other recorded verdicts.

Review the evidence and your use of @factiii/runner@0.9.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-19 13:15:43.829Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.