runcastle@1.6.0
⚠ Under reviewBurn tickets into shipped features with Claude Code.
Static Scan Results
scanned 5d ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flaggedbin/runcastle.jsView file
2015async function execOrThrow(exec, engine, args) {
L2016: const out = await exec(engine, args);
L2017: if (!out.ok || out.code !== 0) {
High
Child Process
Package source references child process execution.
bin/runcastle.jsView on unpkg · L20152782if (/\.(cmd|bat)$/i.test(resolved)) {
L2783: return { file: process.env.ComSpec ?? "cmd.exe", args: ["/c", resolved, ...args] };
L2784: }
High
193outcome: GateCommandOutcome,
L194: exitCode: z2.number().nullable(),
L195: reason: z2.string().optional(),
...
L464: purpose: SessionPurpose.optional(),
L465: purposeData: MergeBranchPair.optional(),
L466: ccSessionId: z3.string().optional(),
...
L773: try {
L774: const parsed = JSON.parse(trimmed);
L775: if (parsed && typeof parsed === "object")
...
L1662: function prodDataDir() {
L1663: return join(homedir(), ".runcastle");
L1664: }
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
bin/runcastle.jsFindings
6 High4 Medium5 Low
HighChild Processbin/runcastle.js
HighShellbin/runcastle.js
HighCredential Redirect Persistenceindex.js
HighCommand Output Exfiltrationbin/runcastle.js
HighCross File Remote Execution Contextbin/runcastle.js
HighSemantic Analysis Limitedweb/assets/index-D_nwcaAO.js
MediumDynamic Requirepty-host.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowWeak Cryptobin/runcastle.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to runcastle@1.6.0.
See all versions of runcastle for other recorded verdicts.
- Review the evidence and your use of runcastle@1.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.