registry / @cloop/runner / 0.3.33
@cloop/runner@0.3.33
Make your computer and your agents Cloop machines: device login, the machine daemon, the Cloop MCP server, and Claude Code hooks.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package’s `cloop connect` command can install a missing coding agent, which matches its stated purpose of setting up a Cloop machine. The installer is disclosed during that command, and the Codex download is checksum-verified; no install lifecycle hook or unrelated collection was identified.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs `cloop connect`; the command checks for coding agents and may install a missing one during setup.
Impact
The requested setup can install a coding agent on the user’s machine. No package install-time execution or unrelated data collection was identified.
Mechanism
It invokes the official Claude Code installer from claude.ai or downloads Codex from OpenAI’s GitHub releases; the Codex archive is checksum-verified.
AI rationale
The package’s `cloop connect` command can install a missing coding agent, which matches its stated purpose of setting up a Cloop machine. The installer is disclosed during that command, and the Codex download is checksum-verified; no install lifecycle hook or unrelated collection was identified.
Network endpoints2
claude.aigithub.com/openai/codex/releases/latest/download
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a `cloop` CLI and lists build, development, lint, formatting, typecheck, and test scripts; it has no install lifecycle script.
- The CLI dispatches `connect` to the connect command, where missing coding agents may be installed as part of setup.
- The code announces Claude Code installation through Anthropic’s installer and uses `claude.ai` installer URLs.
- The code announces Codex installation from its GitHub releases and verifies the downloaded archive against the release checksum.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/chunk-WE5HZZLE.jsView file
242// src/spawn-command.ts
L243: import { execFileSync } from "child_process";
L244: function commandFor(bin, args, platform = process.platform, comspec = process.env.ComSpec) {
High
Child Process
Package source references child process execution.
dist/chunk-WE5HZZLE.jsView on unpkg · L242dist/chunk-FIBH3C5S.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @cloop/runner@0.3.18
matchedIdentity = npm:QGNsb29wL3J1bm5lcg:0.3.18
similarity = 0.563
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-FIBH3C5S.jsView on unpkg48windowsExecutable,
L49: windowsPowerShellEnv,
L50: writeBoxConfig
...
L107: import { basename, delimiter, dirname, join, posix, win32 } from "path";
L108: var CODEX_RELEASES = "https://github.[redacted]";
L109: var CODEX_TRIPLES = {
...
L127: var CODEX_SUMS = `${CODEX_RELEASES}/codex-package_SHA256SUMS`;
L128: function codexInstallCommand(home, platform = process.platform, arch = process.arch) {
L129: const asset = codexAsset(platform, arch);
...
L235: }
L236: function findLocalCodex(home, env = process.env) {
L237: findIn(codexBinDir(home), "codex", env);
Findings
1 Critical3 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/chunk-FIBH3C5S.js
HighChild Processdist/chunk-WE5HZZLE.js
HighSandbox Evasion Gated Capabilitydist/chunk-FIBH3C5S.js
HighRuntime Package Installdist/chunk-FIBH3C5S.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @cloop/runner@0.3.33.
See all versions of @cloop/runner for other recorded verdicts.
- Review the evidence and your use of @cloop/runner@0.3.33 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.