runcastle@1.2.7
Burn tickets into shipped features with Claude Code.
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggedbin/runcastle.jsView file
954// src/pty/kill-tree.ts
L955: import { spawn } from "child_process";
L956: function taskkillTree(pid) {
High
887if (/\.(cmd|bat)$/i.test(resolved)) {
L888: return { file: process.env.ComSpec ?? "cmd.exe", args: ["/c", resolved, ...args] };
L889: }
High
2158return {
L2159: file: process.env.ComSpec ?? "cmd.exe",
L2160: args: ["/d", "/s", "/c", `"${command}"`],
...
L2171: const { file, args, verbatim } = hookSpawnTarget(command);
L2172: return new Promise((resolve4) => {
L2173: let output = "";
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/runcastle.jsView on unpkg · L2158Findings
5 High4 Medium4 Low
HighChild Processbin/runcastle.js
HighShellbin/runcastle.js
HighSame File Env Network Executionbin/runcastle.js
HighEntrypoint Foreign Package Code Overwritebin/runcastle.js
HighPrevious Version Dangerous Deltabin/runcastle.js
MediumDynamic Requirepty-host.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowWeak Cryptobin/runcastle.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to runcastle@1.2.7.
See all versions of runcastle for other recorded verdicts.
- Review the evidence and your use of runcastle@1.2.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.