runcastle@1.2.9
Burn tickets into shipped features with Claude Code.
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggedbin/runcastle.jsView file
1073// src/pty/kill-tree.ts
L1074: import { spawn } from "child_process";
L1075: function taskkillTree(pid) {
High
Child Process
Package source references child process execution.
bin/runcastle.jsView on unpkg · L10731005if (/\.(cmd|bat)$/i.test(resolved)) {
L1006: return { file: process.env.ComSpec ?? "cmd.exe", args: ["/c", resolved, ...args] };
L1007: }
High
2279return {
L2280: file: process.env.ComSpec ?? "cmd.exe",
L2281: args: ["/d", "/s", "/c", `"${command}"`],
...
L2292: const { file, args, verbatim } = hookSpawnTarget(command);
L2293: return new Promise((resolve4) => {
L2294: let output = "";
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/runcastle.jsView on unpkg · L2279Findings
5 High4 Medium4 Low
HighChild Processbin/runcastle.js
HighShellbin/runcastle.js
HighSame File Env Network Executionbin/runcastle.js
HighEntrypoint Foreign Package Code Overwritebin/runcastle.js
HighPrevious Version Dangerous Deltabin/runcastle.js
MediumDynamic Requirepty-host.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowWeak Cryptobin/runcastle.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to runcastle@1.2.9.
See all versions of runcastle for other recorded verdicts.
- Review the evidence and your use of runcastle@1.2.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.