runcastle@1.5.3
⚠ Under reviewBurn tickets into shipped features with Claude Code.
Static Scan Results
scanned 12d ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flaggedbin/runcastle.jsView file
1600// src/pty/kill-tree.ts
L1601: import { spawn } from "child_process";
L1602: function taskkillTree(pid) {
High
Child Process
Package source references child process execution.
bin/runcastle.jsView on unpkg · L16001532if (/\.(cmd|bat)$/i.test(resolved)) {
L1533: return { file: process.env.ComSpec ?? "cmd.exe", args: ["/c", resolved, ...args] };
L1534: }
High
199outcome: GateCommandOutcome,
L200: exitCode: z2.number().nullable(),
L201: reason: z2.string().optional(),
...
L482: purpose: SessionPurpose.optional(),
L483: purposeData: MergeBranchPair.optional(),
L484: ccSessionId: z3.string().optional(),
...
L854: try {
L855: const parsed = JSON.parse(trimmed);
L856: if (parsed && typeof parsed === "object")
...
L1180: function prodDataDir() {
L1181: return join(homedir(), ".runcastle");
L1182: }
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
bin/runcastle.jsView on unpkg · L199Findings
6 High4 Medium5 Low
HighChild Processbin/runcastle.js
HighShellbin/runcastle.js
HighCredential Redirect Persistenceindex.js
HighCommand Output Exfiltrationbin/runcastle.js
HighCross File Remote Execution Contextbin/runcastle.js
HighSemantic Analysis Limitedhook-client.ts#virtual:normalized:round1
MediumDynamic Requirepty-host.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowWeak Cryptobin/runcastle.js
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to runcastle@1.5.3.
See all versions of runcastle for other recorded verdicts.
- Review the evidence and your use of runcastle@1.5.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.