runcastle@1.5.4
⚠ Under reviewBurn tickets into shipped features with Claude Code.
Static Scan Results
scanned 11d ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flaggedbin/runcastle.jsView file
1479// src/pty/kill-tree.ts
L1480: import { spawn } from "child_process";
L1481: function taskkillTree(pid) {
High
Child Process
Package source references child process execution.
bin/runcastle.jsView on unpkg · L14791411if (/\.(cmd|bat)$/i.test(resolved)) {
L1412: return { file: process.env.ComSpec ?? "cmd.exe", args: ["/c", resolved, ...args] };
L1413: }
High
193outcome: GateCommandOutcome,
L194: exitCode: z2.number().nullable(),
L195: reason: z2.string().optional(),
...
L466: purpose: SessionPurpose.optional(),
L467: purposeData: MergeBranchPair.optional(),
L468: ccSessionId: z3.string().optional(),
...
L775: try {
L776: const parsed = JSON.parse(trimmed);
L777: if (parsed && typeof parsed === "object")
...
L1059: function prodDataDir() {
L1060: return join(homedir(), ".runcastle");
L1061: }
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
bin/runcastle.jsView on unpkg · L193Findings
6 High4 Medium5 Low
HighChild Processbin/runcastle.js
HighShellbin/runcastle.js
HighCredential Redirect Persistenceindex.js
HighCommand Output Exfiltrationbin/runcastle.js
HighCross File Remote Execution Contextbin/runcastle.js
HighSemantic Analysis Limitedhook-client.ts#virtual:normalized:round1
MediumDynamic Requirepty-host.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowWeak Cryptobin/runcastle.js
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to runcastle@1.5.4.
See all versions of runcastle for other recorded verdicts.
- Review the evidence and your use of runcastle@1.5.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.