registry / loomctl / 0.19.0

loomctl@0.19.0

Orchestrate a fleet of real Claude Code agents on your Claude subscription (Pro/Max), not per-token API bills — durable sessions, multi-agent orchestration, all local-first on your own machine.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `loom` to start/manage sessions, or explicitly runs `loom service install`.

Impact

Loom can pre-accept workspace trust and influence Claude sessions in projects it manages; no install-time or foreign-network exfiltration chain was confirmed.

Mechanism

Claude configuration mutation, project-local skill injection, local agent orchestration, and authenticated usage polling.

Rationale

No malicious install hook, stealth persistence, remote payload execution, or unrelated exfiltration was found. The package nonetheless performs explicit user-command mutation of Claude trust and skill surfaces, so it warrants a warning rather than a clean verdict.

Evidence

package.jsonbin/loom.mjsbin/service.mjsdist/pty/host.jsdist/pty/claude-config.jsdist/skills/inject.jsdist/orchestration/usage-status.jsdist/git/worktrees.js~/.claude.json<cwd>/.claude/skills<cwd>/.git/info/exclude~/.claude/.credentials.json<worktree>/node_modules

Network endpoints2

api.anthropic.com/api/oauth/usage127.0.0.1

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/pty/claude-config.js` writes trust/onboarding flags to `~/.claude.json` for each spawned workspace.
`dist/skills/inject.js` copies Loom skills into `<cwd>/.claude/skills`, shadowing personal Claude skills.
`dist/orchestration/usage-status.js` reads Claude OAuth credentials and sends the token to Anthropic's usage endpoint.
`dist/git/worktrees.js` runs bounded package-manager installs in user-project worktrees.

Evidence against

`package.json` has no lifecycle scripts; install does not execute this behavior.
Agent configuration writes occur when the user starts Loom-managed Claude sessions.
Credential network use is limited to `https://api.anthropic.com/api/oauth/usage` with an Anthropic bearer token.
`bin/service.mjs` service registration is an explicit `loom service install` action.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 144 file(s), 4.31 MB of source, external domains: 127.0.0.1, accounts.google.com, api.anthropic.com, api.telegram.org, github.com, oauth2.googleapis.com, react.dev, registry.npmjs.org, schemas.microsoft.com, www.w3.org

Source & flagged code

9 flagged

bin/loom.mjsView file

Lines 1-42javascript

1#!/usr/bin/env node

2// The public `loom` CLI — a small MANAGEMENT CLI over the single-process daemon (which serves the

3// prebuilt web viewport from its own loopback origin — Releases v1 Part 1).

4//

5// loom start the daemon in the FOREGROUND + open the browser (backward-compatible:

6// byte-identical to the original bare `loom`; same as `loom start`)

7// loom start [-d] start the daemon. --detach/-d backgrounds it + writes a PID file

8// loom stop gracefully stop a running (detached) daemon + clean the PID file

9// loom status report running/stopped + version + URL + PID (exit non-zero if not running)

10// loom restart stop, then start (honors --detach/--port/--no-open)

11// loom open open the browser to a running daemon

12// loom update [--channel stable|beta]

13// upgrade in place (npm i -g loomctl@<dist-tag>) + restart the daemon

14//

15// This file is shipped at <pkg>/bin/loom.mjs and the daemon at <pkg>/dist/index.js — the assembled npm

16// package layout (see scripts/build-npm-package.mjs). It is NOT meant to run from the monorepo source

17// tree (there is no <repo-root>/dist); use `pnpm daemon` for dev.

18import { pathToFileURL, fileURLToPath } from "node:url";

19import path from "node:path";

20import os from "node:os";

21import fs from "node:fs";

22import http from "node:http";

23import { spawn, spawnSync } from "node:child_process";

24import { CHANNELS, isValidChannel, installSpecFor, readChannel, writeChannel } from "./update-config.mjs";

High

Child Process

Package source references child process execution.

bin/loom.mjsView on unpkg · L22

26// UV_THREADPOOL_SIZE (task dea6728e, defense-in-depth): the default libuv pool is only 4 threads, so a

27// small handful of wedged fs ops could starve fs/dns/crypto process-wide. `startDetached`/`loom service`

28// spawn a FRESH node process for the daemon, where setting this on that child's env reliably works.

29// `startForeground` instead runs the daemon IN-PROCESS (the OS-service path: `loom start --no-open`) via

30// a dynamic import — by the time that import runs, this process's own ESM module loading has likely

31// already touched the threadpool, so this assignment is BEST-EFFORT for that path only, never a

32// guarantee (libuv reads the env var once, lazily, on first threadpool use — there is no in-process way

33// to resize it after the fact). Never overrides an operator's own explicit setting.

34if (!process.env.UV_THREADPOOL_SIZE) process.env.UV_THREADPOOL_SIZE = "16";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/loom.mjsView on unpkg · L21

36const here = path.dirname(fileURLToPath(import.meta.url));

37const pkgRoot = path.resolve(here, ".."); // the installed `loom` package root (holds the umbrella package.json)

38const DEFAULT_PORT = 4317;

39const SUBCOMMANDS = new Set(["start", "stop", "status", "restart", "open", "service", "update"]);

40const SERVICE_ACTIONS = new Set(["install", "uninstall", "status"]);

42function readVersion() {

Lines 250-290javascript

250

251function resolveDaemonEntry() {

252 const daemonEntry = path.join(pkgRoot, "dist", "index.js");

253 if (!fs.existsSync(daemonEntry)) {

254 console.error(`loom: daemon entry not found at ${daemonEntry}

255This package looks incomplete (was it built/assembled with scripts/build-npm-package.mjs?).`);

Lines 429-469javascript

429 const rec = readPidFile();

430 const port = explicitPort ?? rec?.port ?? (process.env.LOOM_PORT ? Number(process.env.LOOM_PORT) : DEFAULT_PORT);

431 const wasRunning = !!(await

dist/mcp/repo-read.jsView file

Lines 42-82javascript

42// (exponential) backtracking pattern like /(a+)+$/: empirically, even a ~25-30 char adversarial input

43// already takes multiple SECONDS and scales exponentially from there, so even a 500-char (MAX_LINE_LEN)

44// clamp never returns unguarded — and normal source lines (~30-120 chars) sit exactly in that danger zone,

45// so there is no length threshold that's both safe and useful. The real boundary is a hard wall-clock

46// ceiling via V8 isolate termination (`vm.runInContext(..., {timeout})`, confirmed by direct testing to

47// interrupt mid-backtrack — unlike a plain synchronous `.test()`, which cannot be preempted once started).

48// That vm crossing is paid ONCE PER FILE, not once per line (a per-line crossing measured ~0.3ms/call —

49// an always-paid tax that would make a broad grep itself slow): `GREP_FILE_TIMEOUT_MS` bounds ONE

50// vm.runInContext call that runs the WHOLE per-file match loop (every clamped line probe against `rx`);

bin/service.mjsView file

Lines 1-30javascript

1// `loom service install | uninstall | status` — register Loom to AUTOSTART in the background on

2// login/boot, on all three OSes. This is the management-CLI companion to bin/loom.mjs (Epic 2b).

3//

4// ARCHITECTURE (decided by the Lead — see the task): END USERS get NO supervisor

5// (scripts/daemon-supervisor.mjs is NOT shipped in the npm package). So the registered OS service runs

6// **`loom start --no-open`** in the FOREGROUND and the OS service manager owns the lifecycle +

7// keep-alive/restart:

8// - Linux : a systemd --user unit (Restart=on-failure, WantedBy=default.target) under

9// ~/.config/systemd/user, enabled+started via `systemctl --user`.

10// - macOS : a launchd LaunchAgent plist (RunAtLoad + KeepAlive) under ~/Library/LaunchAgents,

dist/git/worktrees.jsView file

Lines 72-112javascript

72/**

73 * Bound on the captured stdout+stderr TAIL kept per provisioning child — enough to diagnose a real

74 * failure (the actual tool error, e.g. an npm/pnpm/yarn error block) without letting a noisy/failing

75 * install grow the buffer unboundedly in memory before the child is killed or exits. Mirrors the

76 * markitdown provisioning-status pattern's captured ~4KB error tail (see CLAUDE.md).

77 */

78const OUTPUT_TAIL_MAX_CHARS = 4000;

79/** Append `chunk` to `tail`, keeping only the LAST {@link OUTPUT_TAIL_MAX_CHARS

assets/python/synthesize.pyView file

•path = assets/python/synthesize.py kind = build_helper sizeBytes = 11311 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/python/synthesize.pyView on unpkg

dist/pty/host.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = loomctl@0.18.0 matchedIdentity = npm:bG9vbWN0bA:0.18.0 similarity = 0.867 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/pty/host.jsView on unpkg

Source & flagged code

9 flagged · loading source

bin/loom.mjsView file

22import http from "node:http"; L23: import { spawn, spawnSync } from "node:child_process"; L24: import { CHANNELS, isValidChannel, installSpecFor, readChannel, writeChannel } from "./update-config.mjs";

High

Child Process

Package source references child process execution.

bin/loom.mjsView on unpkg · L22

449// no shell-injection surface. L450: const r = spawnSync("npm", ["i", "-g", spec], { stdio: "inherit", shell: true }); L451: if (r.error || r.status !== 0) {

High

Shell

Package source references shell execution.

bin/loom.mjsView on unpkg · L449

21import fs from "node:fs"; L22: import http from "node:http"; L23: import { spawn, spawnSync } from "node:child_process"; L24: import { CHANNELS, isValidChannel, installSpecFor, readChannel, writeChannel } from "./update-config.mjs"; ... L33: // to resize it after the fact). Never overrides an operator's own explicit setting. L34: if (!process.env.UV_THREADPOOL_SIZE) process.env.UV_THREADPOOL_SIZE = "16"; L35:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/loom.mjsView on unpkg · L21

270// readiness. L271: await import(pathToFileURL(daemonEntry).href); L272:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/loom.mjsView on unpkg · L270

dist/mcp/repo-read.jsView file

62for (let i = 0; i < s.length; i++) L63: if (s.charCodeAt(i) === 0) L64: return true;

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/mcp/repo-read.jsView on unpkg · L62

bin/service.mjsView file

10// - macOS : a launchd LaunchAgent plist (RunAtLoad + KeepAlive) under ~/Library/LaunchAgents, L11: // loaded via `launchctl`. L12: // - Windows: a Task Scheduler logon task (schtasks /create /xml) running at logon — no admin / no ... L22: import path from "node:path"; L23: import { spawnSync } from "node:child_process"; L24: ... L74: // launchd LaunchAgent plist. RunAtLoad starts it when the agent is loaded at login; KeepAlive restarts L75: // it if it exits (the keep-alive). Stdout/stderr go to a log under LOOM_HOME so a background boot stays L76: // debuggable. ... L118: return `<?xml version="1.0" encoding="UTF-16"?> L119: <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> L120: <RegistrationInfo>

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/service.mjsView on unpkg · L10

dist/git/worktrees.jsView file

92/** L93: * Run a BOUNDED, NON-INTERACTIVE `pnpm install --frozen-lockfile --prefer-offline` in `worktreePath`, L94: * killing the child if it exceeds `timeoutMs`. ASYNC (child_process.spawn, NOT spawnSync) on purpose: L95: * createWorktree is awaited on the worker-spawn hot path, and a synchronous spawnSync would freeze the

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/git/worktrees.jsView on unpkg · L92

assets/python/synthesize.pyView file

•path = assets/python/synthesize.py kind = build_helper sizeBytes = 11311 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/python/synthesize.pyView on unpkg

dist/pty/host.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/pty/host.jsView on unpkg

Findings

1 Critical4 High7 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/pty/host.js

HighChild Processbin/loom.mjs

HighShellbin/loom.mjs

HighSame File Env Network Executionbin/loom.mjs

HighRuntime Package Installdist/git/worktrees.js

MediumDynamic Requirebin/loom.mjs

MediumUnsafe Vm Contextdist/mcp/repo-read.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/service.mjs

MediumShips Build Helperassets/python/synthesize.py

MediumStructural Risk Force Deep Review

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings