registry / @cloop/runner / 0.3.46
@cloop/runner@0.3.46
⚠ Under reviewMake your computer and your agents Cloop machines: device login, the machine daemon, the Cloop MCP server, and Claude Code hooks.
Static Scan Results
scanned 7h ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/chunk-SBYSVZ7J.jsView file
84// src/presence.ts
L85: import { execFileSync as execFileSync2 } from "child_process";
L86: import { randomUUID } from "crypto";
High
Child Process
Package source references child process execution.
dist/chunk-SBYSVZ7J.jsView on unpkg · L84dist/chunk-42ABTDLJ.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @cloop/runner@0.3.41
matchedIdentity = npm:QGNsb29wL3J1bm5lcg:0.3.41
similarity = 0.875
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-42ABTDLJ.jsView on unpkg49windowsExecutable,
L50: windowsPowerShellEnv,
L51: writeBoxConfig
...
L108: import { basename, delimiter, dirname, join, posix, win32 } from "path";
L109: var CODEX_RELEASES = "https://github.[redacted]";
L110: var CODEX_TRIPLES = {
...
L128: var CODEX_SUMS = `${CODEX_RELEASES}/codex-package_SHA256SUMS`;
L129: function codexInstallCommand(home, platform = process.platform, arch = process.arch) {
L130: const asset = codexAsset(platform, arch);
...
L236: }
L237: function findLocalCodex(home, env = process.env) {
L238: findIn(codexBinDir(home), "codex", env);
Findings
1 Critical3 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/chunk-42ABTDLJ.js
HighChild Processdist/chunk-SBYSVZ7J.js
HighSandbox Evasion Gated Capabilitydist/chunk-42ABTDLJ.js
HighRuntime Package Installdist/chunk-42ABTDLJ.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @cloop/runner@0.3.46.
See all versions of @cloop/runner for other recorded verdicts.
- Review the evidence and your use of @cloop/runner@0.3.46 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.