registry / @cloop/runner / 0.3.34
@cloop/runner@0.3.34
Make your computer and your agents Cloop machines: device login, the machine daemon, the Cloop MCP server, and Claude Code hooks.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged download-and-run behavior is part of the user-invoked `cloop connect` setup and targets official Claude and OpenAI distribution sources. Codex assets are checksum-verified, and the manifest has no install lifecycle hook.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user explicitly runs `cloop connect`; harness installation is considered when a supported harness is missing or needs an update.
Impact
Installs a coding harness for the requested Cloop setup; no unrelated collection or concealed execution was identified.
Mechanism
The package invokes the official Claude Code installer or downloads Codex from OpenAI's GitHub releases and verifies its SHA-256 checksum.
AI rationale
The flagged download-and-run behavior is part of the user-invoked `cloop connect` setup and targets official Claude and OpenAI distribution sources. Codex assets are checksum-verified, and the manifest has no install lifecycle hook.
Network endpoints3
github.com/openai/codex/releases/latest/downloadclaude.ai/install.ps1claude.ai/install.sh
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes dist/index.js as the CLI and lists no install, preinstall, or postinstall lifecycle script.
- The CLI invokes the connect command only for an explicit `cloop connect` invocation.
- During connect setup, the package announces that it is installing Codex and calls the installer through its agent-preparation flow.
- Codex is downloaded from OpenAI's GitHub releases and checked against its published SHA-256 sums before extraction.
- The Claude Code installer URL is the official claude.ai installer.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/chunk-SBYSVZ7J.jsView file
84// src/presence.ts
L85: import { execFileSync as execFileSync2 } from "child_process";
L86: import { randomUUID } from "crypto";
High
Child Process
Package source references child process execution.
dist/chunk-SBYSVZ7J.jsView on unpkg · L84dist/chunk-MAUIATJ5.jsView file
48windowsExecutable,
L49: windowsPowerShellEnv,
L50: writeBoxConfig
...
L107: import { basename, delimiter, dirname, join, posix, win32 } from "path";
L108: var CODEX_RELEASES = "https://github.[redacted]";
L109: var CODEX_TRIPLES = {
...
L127: var CODEX_SUMS = `${CODEX_RELEASES}/codex-package_SHA256SUMS`;
L128: function codexInstallCommand(home, platform = process.platform, arch = process.arch) {
L129: const asset = codexAsset(platform, arch);
...
L235: }
L236: function findLocalCodex(home, env = process.env) {
L237: findIn(codexBinDir(home), "codex", env);
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/chunk-MAUIATJ5.jsView on unpkg · L48Findings
1 Critical3 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/chunk-3ZZLIPFM.js
HighChild Processdist/chunk-SBYSVZ7J.js
HighSandbox Evasion Gated Capabilitydist/chunk-MAUIATJ5.js
HighRuntime Package Installdist/chunk-MAUIATJ5.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @cloop/runner@0.3.34.
See all versions of @cloop/runner for other recorded verdicts.
- Review the evidence and your use of @cloop/runner@0.3.34 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.