registry / @cloop/runner / 0.3.18
@cloop/runner@0.3.18
Make your machine and your agents Cloop runners: device login, the runner daemon, the Cloop MCP server, and Claude Code hooks.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe flagged execution is part of the package’s disclosed runner behavior, activated by the user’s connect command. The inspected manifest has no install hook, and the reviewed source did not establish a separate attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user invokes the cloop connect command to set up a runner.
Impact
This grants connected tasks broad execution capability, disclosed during local runner setup; inspected source did not establish a separate attack.
Mechanism
The runner launches the selected harness for connected tasks, including Codex with approval and sandbox checks bypassed.
AI rationale
The flagged execution is part of the package’s disclosed runner behavior, activated by the user’s connect command. The inspected manifest has no install hook, and the reviewed source did not establish a separate attack.
Evidence
package.jsondist/index.jsdist/chunk-HVXCQQWG.jsdist/box-AF56GPSV.js.lpm-dependency-evidence-c81e9f4b-88c2-49ad-acaa-cdfa2b4b664a/0/npm-linux/dist/mcp-DIH4cS6P.mjs.lpm-dependency-evidence-c81e9f4b-88c2-49ad-acaa-cdfa2b4b664a/1/npm-linux/lib/websocket.js.lpm-dependency-evidence-c81e9f4b-88c2-49ad-acaa-cdfa2b4b664a/0/npm-linux/package.json.lpm-dependency-evidence-c81e9f4b-88c2-49ad-acaa-cdfa2b4b664a/0/npm-linux/dist/index.mjs.lpm-dependency-evidence-c81e9f4b-88c2-49ad-acaa-cdfa2b4b664a/0/npm-linux/dist/stdio.mjs.lpm-dependency-evidence-c81e9f4b-88c2-49ad-acaa-cdfa2b4b664a/1/npm-linux/package.json.lpm-dependency-evidence-c81e9f4b-88c2-49ad-acaa-cdfa2b4b664a/1/npm-linux/wrapper.mjs.lpm-dependency-evidence-c81e9f4b-88c2-49ad-acaa-cdfa2b4b664a/1/npm-linux/browser.js.lpm-dependency-evidence-c81e9f4b-88c2-49ad-acaa-cdfa2b4b664a/1/npm-linux/index.js
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes dist/index.js as the CLI and declares no lifecycle hooks.
- The runner connects only through the explicit connect command; local setup reports that tasks run without permission checks.
- Codex’s bypass flags are part of the runner’s task execution command, consistent with that disclosed behavior.
- The inspected dependency paths show MCP server and WebSocket implementation code, with no install scripts in their manifests.
Evidence against
- The runner deliberately starts Codex with approval and sandbox protections bypassed.
- The box command reads recent Claude session metadata, which may be shared as part of runner functionality.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/chunk-HVXCQQWG.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @cloop/runner@0.3.17
matchedIdentity = npm:QGNsb29wL3J1bm5lcg:0.3.17
similarity = 0.909
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-HVXCQQWG.jsView on unpkg71// src/commands/connect.ts
L72: import { execFileSync as execFileSync2, spawnSync } from "child_process";
L73: import { randomUUID } from "crypto";
High
Child Process
Package source references child process execution.
dist/chunk-HVXCQQWG.jsView on unpkg · L7132windowsExecutable,
L33: windowsPowerShellEnv,
L34: writeBoxConfig
...
L90: import { delimiter, join, posix, win32 } from "path";
L91: var CODEX_RELEASES = "https://github.[redacted]";
L92: var CODEX_TRIPLES = {
...
L105: var psQuote = (value) => `'${value.replace(/'/g, "''")}'`;
L106: function codexInstallCommand(home, platform = process.platform, arch = process.arch) {
L107: const asset = codexAsset(platform, arch);
...
L175: }
L176: function findLocalCodex(home, env = process.env) {
L177: findIn(codexBinDir(home), "codex", env);
Findings
1 Critical4 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/chunk-HVXCQQWG.js
HighChild Processdist/chunk-HVXCQQWG.js
HighSandbox Evasion Gated Capabilitydist/chunk-HVXCQQWG.js
HighRuntime Package Installdist/chunk-HVXCQQWG.js
HighSemantic Analysis Limiteddist/box-AF56GPSV.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @cloop/runner@0.3.18.
See all versions of @cloop/runner for other recorded verdicts.
- Review the evidence and your use of @cloop/runner@0.3.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.