registry / @agentdock/daemon / 0.0.97
@agentdock/daemon@0.0.97
PC daemon + CLI for AgentDock — ACP abstraction, TransportHandler, process management
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe flagged execution, network, and persistence primitives implement the daemon's runtime behavior with pairing and local authentication controls. Static inspection found no concrete malicious chain, install-hook abuse, or unrelated credential recipient.
Static reason
One or more suspicious static signals were detected.
Trigger
CLI invocation or authenticated daemon requests activate these functions; npm installation has no lifecycle trigger.
Impact
These functions manage agent sessions and daemon availability; inspected source did not establish covert credential export or malicious persistence.
Mechanism
The package launches its daemon, handles authenticated loopback RPC, connects using server-specific credentials, and installs updates through npm.
AI rationale
The flagged execution, network, and persistence primitives implement the daemon's runtime behavior with pairing and local authentication controls. Static inspection found no concrete malicious chain, install-hook abuse, or unrelated credential recipient.
Network endpoints3
127.0.0.1registry.npmjs.orgregistry.npmmirror.com
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no install lifecycle hooks or runtime self-dependency; its entrypoints expose the daemon library and CLI.
- Upgrade commands implement package updates, validate CLI registry input, and guard session interruption.
- dist/ensureDaemon.js launches the local daemon and sends authenticated registration requests to loopback, without command-output exfiltration.
- Autostart configures this daemon's login service and skips setup when credentials are absent or autostart is disabled.
- The local control server binds to loopback and requires bearer authentication for RPC requests.
- Pairing credentials are stored by server URL; endpoint-specific lookup returns only that server's credentials.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
8 flaggeddist/triggerUpgradeRpc.jsView file
1"use strict";import{execSync as S}from"node:child_process";import{errorMessage as i,SOCKET_EVENTS as y}from"@agentdock/wire";import{triggerUpgrade as h,runPreflight as w,executeSwa...
High
Child Process
Package source references child process execution.
dist/triggerUpgradeRpc.jsView on unpkg · L1dist/upgradeCommand.jsView file
4`),await B(" Press Enter when ready... "));const r=await k(t,e);if(r.length===0){a("All sessions closed");return}p(`Stopping ${r.length} remaining session(s)...`);for(const o of r...
L5: `);v.writeFileSync(r,h,"utf-8"),D("cmd.exe",["/c",r],{detached:!0,stdio:"ignore",windowsHide:!0}).unref(),f(`Upgrade will complete after this process exits.
L6: `),process.exit(0)}function J(t,e){try{return i(`npm install -g ${s}@latest${t}`,{stdio:"inherit"}),a(`${s} upgraded successfully!`),i(`${g} --version`,{stdio:"inherit"}),!0}catch{...
High
Findings
7 High4 Medium5 Low
HighChild Processdist/triggerUpgradeRpc.js
HighShelldist/upgradeCommand.js
HighSame File Env Network Executiondist/ensureDaemon.js
HighCommand Output Exfiltrationdist/ensureDaemon.js
HighTrigger Reachable Command Output Exfiltrationdist/ensureDaemon.js
HighTrigger Reachable Persistencedist/autostart.js
HighRuntime Package Installdist/triggerUpgrade.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/autostart.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @agentdock/daemon@0.0.97.
See all versions of @agentdock/daemon for other recorded verdicts.
- Review the evidence and your use of @agentdock/daemon@0.0.97 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.