registry / @runuai/host / 0.4.0

@runuai/host@0.4.0

Uai host — runs ephemeral AI coding tasks in Docker on a machine you control.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package is a self-hosted AI task runner with explicit CLI setup, runtime WebSocket control, Docker task orchestration, and user-invoked service installation.

Static reason

No blocking static signals were detected.

Trigger

Explicit user commands such as uai-host setup, run, install, start, or task launch through the host service.

Impact

Runs local task containers and may copy configured AI/Git credentials into task-private containers as part of documented operation.

Mechanism

user-invoked host service and Docker task orchestration

Rationale

Static inspection found explicit, package-aligned service installation and task orchestration behavior, not unconsented npm lifecycle mutation, stealth persistence, exfiltration, or remote payload execution. Credential handling is part of the host/task workflow and is directed to local task containers or configured cloud endpoints rather than hidden third-party collection.

Evidence

package.jsonbin/uai-host.mjssrc/cli.tssrc/main.tsscripts/install/darwin.tsscripts/install/linux.tsscripts/install/win.tsscripts/agent/task-up.shlib/agent.ts~/.uai/.env.local~/Library/LaunchAgents/com.runuai.host.plist~/Library/Logs/Uai/~/.config/systemd/user/uai-host.service%LOCALAPPDATA%/Uai/service/uai-host.exe

@runuai/host@0.4.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code