@loop-lang/loop
Install LoopFlow (.loop) into any repo so Claude Code — or any agent — can author and run self-correcting, human-gated coding loops.
This report shows the evidence for @loop-lang/loop@0.7.1. 1 of 2 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiAlthough the package is otherwise transparent and lacks exfiltration or destructive behavior, the global postinstall hook performs an unconsented lifecycle write into Claude Code's skill directory. Under the firewall policy, lifecycle AI-agent control-surface mutation is block-worthy even when the payload is package-aligned. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.
Decision evidence
public snapshot- package.json defines postinstall: node src/postinstall.mjs.
- src/postinstall.mjs runs on global install and copies assets/skill to ~/.claude/skills/loopflow without prompting.
- The copied asset is a Claude Code skill that can author and run .loop agent workflows.
- src/init.mjs also writes AGENTS.md, CLAUDE.md, .cursor rules, copilot instructions, and .claude/skills when user runs loop init.
- No credential harvesting, exfiltration, obfuscation, native binary loading, or network calls found in src/*.mjs.
- postinstall skips non-global installs and does not overwrite an existing ~/.claude/skills/loopflow.
- README.md discloses that init scaffolds .claude/skills/loopflow and agent memory pointers.
- Skill content is package-aligned documentation/workflow guidance rather than secret theft or destructive code.
Source & flagged code
2 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @loop-lang/loop@0.7.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @loop-lang/loop@0.7.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.