registry / wildcrane-runner / 0.6.15
wildcrane-runner@0.6.15
WildCrane's Local Runner — connects this computer to WildCrane and runs its jobs on your local Claude Code, Codex, OpenCode or Cursor.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package presents itself as a local runner and the inspected startup and update flow match that purpose. Credential-variable references map provider keys into selected agent configuration; the review found no concrete path sending discovered credentials to an unrelated host.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
The user starts the wildcrane-runner command; the runner then connects to WildCrane and handles jobs.
Impact
The inspected behavior supports the package’s local-agent workflow; no automatic credential transfer to an unrelated host or unrelated install-time action was established.
Mechanism
The launcher starts the bundled runner and may retrieve a runner release from the npm registry, verifying its published integrity before extraction. Provider keys are configured for the selected agent or gateway.
AI rationale
The package presents itself as a local runner and the inspected startup and update flow match that purpose. Credential-variable references map provider keys into selected agent configuration; the review found no concrete path sending discovered credentials to an unrelated host.
Evidence
~/.wildcrane/machine.json~/.wildcrane/bin/runner/<version>
Network endpoints4
api.ai4kanban.devyajrbpprmdvtkvjjfpbk.supabase.coregistry.npmjs.orgcursor.com
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a local runner that connects to WildCrane and runs jobs through local coding agents.
- The prepare script runs a build script; the manifest lists only bin/ and dist/ in the published files.
- Provider configuration describes a user-supplied gateway key passed to the selected agent under ANTHROPIC_AUTH_TOKEN.
- The launcher fetches runner releases from the npm registry and checks the tarball against its published SHA-512 integrity value before extraction.
- The Cursor install command is stored as agent setup metadata; the inspected excerpt does not show it running during package startup.
Evidence against
- The launcher executes the runner as a child process and checks for updates while connected; these actions fit the package’s stated purpose.
- The bundle contains credential-variable names and shell command strings, but the inspected contexts place them in provider configuration and agent setup metadata.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
9 flaggeddist/akb/dist/kanban.mjsView file
58* Constructs the CommanderError class
L59: * @param {number} exitCode suggested exit code which could be used with process.exit
L60: * @param {string} code an id string representing the error
...
L1168: var EventEmitter = __require("node:events").EventEmitter;
L1169: var childProcess = __require("node:child_process");
L1170: var path87 = __require("node:path");
...
L1218: this._outputConfiguration = {
L1219: writeOut: (str5) => process2.stdout.write(str5),
L1220: writeErr: (str5) => process2.stderr.write(str5),
...
L1257: * @returns {Command[]}
L1258: * @private
L1259: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/akb/dist/kanban.mjsView on unpkg · L581168var EventEmitter = __require("node:events").EventEmitter;
L1169: var childProcess = __require("node:child_process");
L1170: var path87 = __require("node:path");
High
Child Process
Package source references child process execution.
dist/akb/dist/kanban.mjsView on unpkg · L11682008}
L2009: const execArgv = process2.execArgv ?? [];
L2010: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
Findings
1 Critical5 High5 Medium6 Low
CriticalCredential Exfiltrationdist/akb/dist/kanban.mjs
HighChild Processdist/akb/dist/kanban.mjs
HighShelldist/akb/dist/kanban.mjs
HighSame File Env Network Executiondist/launcher.mjs
HighCommand Output Exfiltrationdist/akb/dist/kanban.mjs
HighKnown Malware Source Similaritydist/akb/dist/kanban.mjs
MediumDynamic Requiredist/akb/bin/ai4kanban.mjs
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/runner.mjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to wildcrane-runner@0.6.15.
See all versions of wildcrane-runner for other recorded verdicts.
- Review the evidence and your use of wildcrane-runner@0.6.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.