runcastle@1.6.3
Burn tickets into shipped features with Claude Code.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe source sends limited, package-related runtime telemetry to its own update endpoint automatically when the server starts. The package provides a DO_NOT_TRACK opt-out, but I found no disclosure in the inspected published files, so this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
The user starts the runcastle server; DO_NOT_TRACK opts out of the ping request.
Impact
The package operator can associate update checks with a stable installation identifier; no credentials or project data were observed in this request.
Mechanism
The update check POSTs the locally persisted install UUID, package version, and platform to the package’s ping endpoint.
AI rationale
The source sends limited, package-related runtime telemetry to its own update endpoint automatically when the server starts. The package provides a DO_NOT_TRACK opt-out, but I found no disclosure in the inspected published files, so this warrants a warning rather than a block.
Evidence
bin/runcastle.jsdataDir()/install-id
Network endpoints2
ping.runcastle.devregistry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Starting the server automatically runs the update check.
- The default check POSTs an install UUID, package version, and platform to ping.runcastle.dev; the UUID is generated and persisted locally.
- DO_NOT_TRACK switches the check to the npm registry instead of the ping endpoint.
- The manifest declares a CLI binary and no lifecycle scripts; the CLI calls main only when invoked directly.
Evidence against
- The ping endpoint is the package’s own update service, and its response is used to check for a newer version.
- The reported credential flow is not supported by the inspected code: the Claude token check removes inherited Anthropic credential variables before launching the local Claude CLI.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinified
Source & flagged code
8 flaggedbin/runcastle.jsView file
2190// src/workflows/burn-user.ts
L2191: import { spawnSync } from "child_process";
L2192: function runId(args) {
High
Child Process
Package source references child process execution.
bin/runcastle.jsView on unpkg · L21903108if (/\.(cmd|bat)$/i.test(resolved)) {
L3109: return { file: process.env.ComSpec ?? "cmd.exe", args: ["/c", resolved, ...args] };
L3110: }
High
193outcome: GateCommandOutcome,
L194: exitCode: z2.number().nullable(),
L195: reason: z2.string().optional(),
...
L465: purpose: SessionPurpose.optional(),
L466: purposeData: MergeBranchPair.optional(),
L467: ccSessionId: z3.string().optional(),
...
L617: }
L618: var REVIEWS_BASE = "/api/reviews", REVIEW_ARTIFACTS_ROUTE = "/:featureId", REVIEW_WALKTHROUGH_ROUTE = "/ticket/:ticketId/walkthrough.webm", REVIEW_GATE_LOG_ROUTE = "/ticket/:ticket...
L619: var init_routes = __esm(() => {
...
L850: try {
L851: const parsed = JSON.parse(trimmed);
L852: if (parsed && typeof parsed === "object")
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
Findings
7 High3 Medium5 Low
HighChild Processbin/runcastle.js
HighShellbin/runcastle.js
HighCredential Redirect Persistenceindex.js
HighCommand Output Exfiltrationbin/runcastle.js
HighObfuscated Payload Loaderbin/runcastle.js
HighCross File Remote Execution Contextbin/runcastle.js
HighSemantic Analysis Limitedbin/runcastle.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowWeak Cryptobin/runcastle.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to runcastle@1.6.3.
See all versions of runcastle for other recorded verdicts.
- Review the evidence and your use of runcastle@1.6.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.