runcastle@1.5.9
⚠ Under reviewBurn tickets into shipped features with Claude Code.
Static Scan Results
scanned 6d ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flaggedbin/runcastle.jsView file
2009async function execOrThrow(exec, engine, args) {
L2010: const out = await exec(engine, args);
L2011: if (!out.ok || out.code !== 0) {
High
Child Process
Package source references child process execution.
bin/runcastle.jsView on unpkg · L20092776if (/\.(cmd|bat)$/i.test(resolved)) {
L2777: return { file: process.env.ComSpec ?? "cmd.exe", args: ["/c", resolved, ...args] };
L2778: }
High
193outcome: GateCommandOutcome,
L194: exitCode: z2.number().nullable(),
L195: reason: z2.string().optional(),
...
L464: purpose: SessionPurpose.optional(),
L465: purposeData: MergeBranchPair.optional(),
L466: ccSessionId: z3.string().optional(),
...
L773: try {
L774: const parsed = JSON.parse(trimmed);
L775: if (parsed && typeof parsed === "object")
...
L1656: function prodDataDir() {
L1657: return join(homedir(), ".runcastle");
L1658: }
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
bin/runcastle.jsFindings
6 High4 Medium5 Low
HighChild Processbin/runcastle.js
HighShellbin/runcastle.js
HighCredential Redirect Persistenceindex.js
HighCommand Output Exfiltrationbin/runcastle.js
HighCross File Remote Execution Contextbin/runcastle.js
HighSemantic Analysis Limitedweb/assets/index-D_bd1hit.js
MediumDynamic Requirepty-host.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowWeak Cryptobin/runcastle.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to runcastle@1.5.9.
See all versions of runcastle for other recorded verdicts.
- Review the evidence and your use of runcastle@1.5.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.