registry / wildcrane-runner
wildcrane-runner
WildCrane's Local Runner — connects this computer to WildCrane and runs its jobs on your local Claude Code, Codex, OpenCode or Cursor.
This report shows the evidence for wildcrane-runner@0.6.19. 0 of 17 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 21h ago · by lpm-firewall-aiThe package implements a local runner that authenticates with WildCrane and launches a selected coding agent. The flagged credential handling is provider-specific local configuration, and the reviewed network calls use WildCrane endpoints with the runner session token.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Invoking the wildcrane-runner CLI; the --settings option opens its local settings flow.
Impact
The reviewed flows support the package's stated local-runner purpose; no unrelated credential transfer or other attack behavior was identified.
Mechanism
Runner session tokens authenticate requests to WildCrane services. Provider secrets are filtered by selected provider and supplied through the local agent process environment.
AI rationale
The package implements a local runner that authenticates with WildCrane and launches a selected coding agent. The flagged credential handling is provider-specific local configuration, and the reviewed network calls use WildCrane endpoints with the runner session token.
Evidence
~/.wildcrane/machine.json~/.wildcrane/session.json~/.wildcrane/settings.json
Network endpoints2
api.ai4kanban.devyajrbpprmdvtkvjjfpbk.supabase.co
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The prepare script runs the package build; no preinstall, install, or postinstall hook is declared.
- The CLI starts the runner or opens its settings flow when invoked.
- Provider secrets are selected for the chosen agent and passed to its environment.
- Cloud requests use the WildCrane API and Supabase endpoints.
Evidence against
- The key settings describe provider-specific keys as stored locally and only used by providers that need them.
- The secret assignment code filters settings by the selected provider before adding them to the spawned agent environment.
- Cloud API calls authenticate with the runner's session token; no provider key is included in the shown request flow.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
12 flaggeddist/akb/dist/kanban.mjsView file
58* Constructs the CommanderError class
L59: * @param {number} exitCode suggested exit code which could be used with process.exit
L60: * @param {string} code an id string representing the error
...
L1168: var EventEmitter = __require("node:events").EventEmitter;
L1169: var childProcess = __require("node:child_process");
L1170: var path88 = __require("node:path");
...
L1218: this._outputConfiguration = {
L1219: writeOut: (str5) => process2.stdout.write(str5),
L1220: writeErr: (str5) => process2.stderr.write(str5),
...
L1257: * @returns {Command[]}
L1258: * @private
L1259: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/akb/dist/kanban.mjsView on unpkg · L581168var EventEmitter = __require("node:events").EventEmitter;
L1169: var childProcess = __require("node:child_process");
L1170: var path88 = __require("node:path");
High
Child Process
Package source references child process execution.
dist/akb/dist/kanban.mjsView on unpkg · L11682008}
L2009: const execArgv = process2.execArgv ?? [];
L2010: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
Findings
1 Critical8 High5 Medium6 Low
CriticalCredential Exfiltrationdist/akb/dist/kanban.mjs
HighChild Processdist/akb/dist/kanban.mjs
HighShelldist/akb/dist/kanban.mjs
HighSame File Env Network Executiondist/launcher.mjs
HighCredential Redirect Persistencedist/launcher.mjs
HighCommand Output Exfiltrationdist/akb/dist/kanban.mjs
HighSandbox Evasion Gated Capabilitydist/launcher.mjs
HighCross File Remote Execution Contextdist/launcher.mjs
HighKnown Malware Source Similaritydist/akb/dist/kanban.mjs
MediumDynamic Requiredist/akb/bin/ai4kanban.mjs
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to wildcrane-runner@0.6.19.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of wildcrane-runner@0.6.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.