registry / @cloop/runner / 0.3.17
@cloop/runner@0.3.17
Make your machine and your agents Cloop runners: device login, the runner daemon, the Cloop MCP server, and Claude Code hooks.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe static flags point to runtime setup, process execution, and session discovery, but inspected source shows user-invoked runner setup and a bounded, configurable presence feature. The dependency sources reviewed implement ordinary MCP event and WebSocket behavior; the flags do not establish malicious activity.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the runner connect flow and starts the runner.
Impact
This is product-aligned runner presence behavior; inspected source does not establish credential theft, transcript disclosure, or another attack.
Mechanism
When the saved setting permits showing other threads, the runner reads recent local Claude session titles and working directories and includes them in presence data. The CLI documents a flag to hide them.
AI rationale
The static flags point to runtime setup, process execution, and session discovery, but inspected source shows user-invoked runner setup and a bounded, configurable presence feature. The dependency sources reviewed implement ordinary MCP event and WebSocket behavior; the flags do not establish malicious activity.
Evidence
dist/box-MCJBDKDN.jsdist/chunk-LXRCJTHL.jsdist/chunk-OHVU476O.jsdist/index.js
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes its CLI through dist/index.js, and the reviewed integration behavior is activated by the runner connect flow.
- The Claude session reader extracts working directories and short titles from recent local session files; it does not upload transcript contents in this path.
- The CLI describes the other-thread feature and provides a hide flag; the saved setting controls whether those session summaries are included in runner presence.
- The inspected runtime dependencies are MCP server and WebSocket libraries, and the cited runtime operations implement event notification and WebSocket protocol handling.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/box-MCJBDKDN.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @cloop/runner@0.3.0
matchedIdentity = npm:QGNsb29wL3J1bm5lcg:0.3.0
similarity = 0.455
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/box-MCJBDKDN.jsView on unpkg152// src/update.ts
L153: import { execFile, spawn } from "child_process";
L154: import {
High
Child Process
Package source references child process execution.
dist/box-MCJBDKDN.jsView on unpkg · L152dist/chunk-OHVU476O.jsView file
31windowsExecutable,
L32: windowsPowerShellEnv,
L33: writeBoxConfig
...
L89: import { delimiter, join, posix, win32 } from "path";
L90: var CODEX_RELEASES = "https://github.[redacted]";
L91: var CODEX_TRIPLES = {
...
L104: var psQuote = (value) => `'${value.replace(/'/g, "''")}'`;
L105: function codexInstallCommand(home, platform = process.platform, arch = process.arch) {
L106: const asset = codexAsset(platform, arch);
...
L174: }
L175: function findLocalCodex(home, env = process.env) {
L176: findIn(codexBinDir(home), "codex", env);
Findings
1 Critical4 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/box-MCJBDKDN.js
HighChild Processdist/box-MCJBDKDN.js
HighSandbox Evasion Gated Capabilitydist/chunk-OHVU476O.js
HighRuntime Package Installdist/chunk-OHVU476O.js
HighSemantic Analysis Limiteddist/box-MCJBDKDN.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @cloop/runner@0.3.17.
See all versions of @cloop/runner for other recorded verdicts.
- Review the evidence and your use of @cloop/runner@0.3.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.