registry / @cloop/runner / 0.3.14
@cloop/runner@0.3.14
Make your machine and your agents Cloop runners: device login, the runner daemon, the Cloop MCP server, and Claude Code hooks.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe manifest has no install hook, and the inspected high-severity runtime findings resolve to a guarded updater for this package’s own service and reads of session metadata. The reviewed dependency excerpts show ordinary MCP and WebSocket library behavior; no concrete attack behavior was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The runner checks for updates during service operation; the Claude session scan runs when its outside-session listing is requested.
Impact
No confirmed attack impact was established.
Mechanism
The updater checks for a newer valid release and gates handover on matching the installed service and having no active work. The session scan reads recent Claude project files for titles and working directories.
AI rationale
The manifest has no install hook, and the inspected high-severity runtime findings resolve to a guarded updater for this package’s own service and reads of session metadata. The reviewed dependency excerpts show ordinary MCP and WebSocket library behavior; no concrete attack behavior was found.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares only build, typecheck, development, lint, format, and test scripts; its executable is the CLI in dist/index.js, with no install lifecycle hook.
- The runner updater checks npm for a newer valid release after a delay, and proceeds only for an installed service matching this package and when no work is running or in flight; it hands over to the matching @cloop/runner release.
- The agent-integration target reads recent Claude project session files to collect titles and working directories; it does not write agent configuration.
- The inspected MCP server excerpts show event subscription and stdio transport behavior; the ws excerpts expose its package entry points, browser restriction, and WebSocket request handling.
- The package’s CLI update helper updates Claude Code through its named update command and reports the action. No concrete attack behavior was identified in the inspected source.
Evidence against
- The runner can check for and adopt a newer package release automatically while its service is running; the source ties this to the package’s own service and waits for idle work.
- The review inspected the flagged source paths and prepared dependency snapshots; it does not certify the entire dependency graph or all possible release contents.
Source & flagged code
5 flaggeddist/box-E6SANWEH.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @cloop/runner@0.3.0
matchedIdentity = npm:QGNsb29wL3J1bm5lcg:0.3.0
similarity = 0.455
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/box-E6SANWEH.jsView on unpkg149// src/update.ts
L150: import { execFile, spawn } from "child_process";
L151: import {
High
Child Process
Package source references child process execution.
dist/box-E6SANWEH.jsView on unpkg · L149dist/chunk-5CE6AYV3.jsView file
31windowsExecutable,
L32: windowsPowerShellEnv,
L33: writeBoxConfig
...
L89: import { delimiter, join, posix, win32 } from "path";
L90: var CODEX_RELEASES = "https://github.[redacted]";
L91: var CODEX_TRIPLES = {
...
L104: var psQuote = (value) => `'${value.replace(/'/g, "''")}'`;
L105: function codexInstallCommand(home, platform = process.platform, arch = process.arch) {
L106: const asset = codexAsset(platform, arch);
...
L174: }
L175: function findLocalCodex(home, env = process.env) {
L176: findIn(codexBinDir(home), "codex", env);
Findings
1 Critical3 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/box-E6SANWEH.js
HighChild Processdist/box-E6SANWEH.js
HighSandbox Evasion Gated Capabilitydist/chunk-5CE6AYV3.js
HighRuntime Package Installdist/chunk-5CE6AYV3.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @cloop/runner@0.3.14.
See all versions of @cloop/runner for other recorded verdicts.
- Review the evidence and your use of @cloop/runner@0.3.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.