registry / wildcrane-runner / 0.3.0
wildcrane-runner@0.3.0
WildCrane's Local Runner — connects this computer to WildCrane and runs its jobs on your local Codex or Claude Code.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe reviewed code matches the documented local runner behavior: it signs in to WildCrane, checks its own npm package for updates, and executes claimed jobs through local coding agents. The default Codex invocation has broad permissions, but this capability is disclosed as part of the runner’s purpose, and the reviewed source did not show unrelated credential exfiltration or other attack behavior.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
The user starts the runner; after sign-in, it connects and processes jobs sent through the WildCrane service.
Impact
Local agent actions can have broad permissions, but remote task execution is the package’s stated purpose; no unrelated credential collection or malicious behavior was identified.
Mechanism
It authenticates requests to its configured WildCrane API, checks for runner updates from npm, and passes claimed job prompts to a local agent in the selected task folder.
AI rationale
The reviewed code matches the documented local runner behavior: it signs in to WildCrane, checks its own npm package for updates, and executes claimed jobs through local coding agents. The default Codex invocation has broad permissions, but this capability is disclosed as part of the runner’s purpose, and the reviewed source did not show unrelated credential exfiltration or other attack behavior.
Network endpoints3
api.ai4kanban.devyajrbpprmdvtkvjjfpbk.supabase.coregistry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The executable entry point imports the launcher; `prepare` runs a build script, while the package publishes `bin/` and `dist/`.
- The README describes the package as a local runner that signs in to WildCrane and runs tasks sent to local Codex or Claude Code.
- The launcher fetches runner versions from npm and checks the downloaded tarball against the registry’s SHA-512 integrity value.
- Runner API requests use the signed-in account’s bearer token with the configured WildCrane API.
- Jobs are claimed from the runner API and their prompts are passed to a local agent in the selected task folder, consistent with the package’s stated purpose.
Evidence against
- The runner claims remote jobs automatically while it is connected.
- The default Codex command uses `--dangerously-bypass-approvals-and-sandbox`, granting the agent broad local execution ability.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
9 flaggeddist/akb/dist/kanban.mjsView file
58* Constructs the CommanderError class
L59: * @param {number} exitCode suggested exit code which could be used with process.exit
L60: * @param {string} code an id string representing the error
...
L1168: var EventEmitter = __require("node:events").EventEmitter;
L1169: var childProcess = __require("node:child_process");
L1170: var path105 = __require("node:path");
...
L1218: this._outputConfiguration = {
L1219: writeOut: (str5) => process2.stdout.write(str5),
L1220: writeErr: (str5) => process2.stderr.write(str5),
...
L1257: * @returns {Command[]}
L1258: * @private
L1259: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/akb/dist/kanban.mjsView on unpkg · L581168var EventEmitter = __require("node:events").EventEmitter;
L1169: var childProcess = __require("node:child_process");
L1170: var path105 = __require("node:path");
High
Child Process
Package source references child process execution.
dist/akb/dist/kanban.mjsView on unpkg · L11682008}
L2009: const execArgv = process2.execArgv ?? [];
L2010: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
Findings
1 Critical5 High5 Medium6 Low
CriticalCredential Exfiltrationdist/akb/dist/kanban.mjs
HighChild Processdist/akb/dist/kanban.mjs
HighShelldist/akb/dist/kanban.mjs
HighSame File Env Network Executiondist/launcher.mjs
HighCommand Output Exfiltrationdist/akb/dist/kanban.mjs
HighKnown Malware Source Similaritydist/akb/dist/kanban.mjs
MediumDynamic Requiredist/akb/bin/ai4kanban.mjs
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/runner.mjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to wildcrane-runner@0.3.0.
See all versions of wildcrane-runner for other recorded verdicts.
- Review the evidence and your use of wildcrane-runner@0.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.