registry / wildcrane-runner / 0.6.5
wildcrane-runner@0.6.5
WildCrane's Local Runner — connects this computer to WildCrane and runs its jobs on your local Claude Code, Codex, OpenCode or Cursor.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged source configures credentials for local agent processes; runner registration sends the names of stored secret keys rather than their values. The network, process execution, and package update behavior match the documented local-runner purpose.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user invokes the wildcrane-runner command; it connects to WildCrane and runs configured jobs.
Impact
Local agent execution and service communication are the package’s stated purpose; no malicious credential transfer or unrelated execution was found.
Mechanism
The runner contacts its service, starts the selected local agent for a job, and can update itself from the configured npm registry after checking package integrity.
AI rationale
The flagged source configures credentials for local agent processes; runner registration sends the names of stored secret keys rather than their values. The network, process execution, and package update behavior match the documented local-runner purpose.
Network endpoints3
api.ai4kanban.devyajrbpprmdvtkvjjfpbk.supabase.coregistry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a local runner that connects to WildCrane and runs jobs using local AI coding tools.
- The bin entry imports the launcher, and the prepare script only builds the package.
- Runner registration reports which provider secret keys are present, not their values; the values are stored locally by provider.
- The launcher downloads its own package from the configured npm registry and checks the tarball’s SHA-512 integrity.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggeddist/akb/dist/kanban.mjsView file
58* Constructs the CommanderError class
L59: * @param {number} exitCode suggested exit code which could be used with process.exit
L60: * @param {string} code an id string representing the error
...
L1168: var EventEmitter = __require("node:events").EventEmitter;
L1169: var childProcess = __require("node:child_process");
L1170: var path86 = __require("node:path");
...
L1218: this._outputConfiguration = {
L1219: writeOut: (str5) => process2.stdout.write(str5),
L1220: writeErr: (str5) => process2.stderr.write(str5),
...
L1257: * @returns {Command[]}
L1258: * @private
L1259: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/akb/dist/kanban.mjsView on unpkg · L581168var EventEmitter = __require("node:events").EventEmitter;
L1169: var childProcess = __require("node:child_process");
L1170: var path86 = __require("node:path");
High
Child Process
Package source references child process execution.
dist/akb/dist/kanban.mjsView on unpkg · L11682008}
L2009: const execArgv = process2.execArgv ?? [];
L2010: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
Findings
2 Critical5 High5 Medium6 Low
CriticalCredential Exfiltrationdist/akb/dist/kanban.mjs
CriticalPrevious Version Dangerous Deltadist/launcher.mjs
HighChild Processdist/akb/dist/kanban.mjs
HighShelldist/akb/dist/kanban.mjs
HighSame File Env Network Executiondist/launcher.mjs
HighCommand Output Exfiltrationdist/akb/dist/kanban.mjs
HighKnown Malware Source Similaritydist/akb/dist/kanban.mjs
MediumDynamic Requiredist/akb/bin/ai4kanban.mjs
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/runner.mjs
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to wildcrane-runner@0.6.5.
See all versions of wildcrane-runner for other recorded verdicts.
- Review the evidence and your use of wildcrane-runner@0.6.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.