registry / AI-agent control-surface risk / @telora/daemon

@telora/daemon

Agent orchestration daemon for Telora - spawns and manages Claude Code instances

This report shows the evidence for @telora/daemon@0.24.36. 2 of 106 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

The dependency’s automatic postinstall modifies global Claude hook settings without affirmative consent, meeting the control-surface hijack criteria. The inspected source does not prove subsequent event-content transmission, so the finding is limited to the configuration change.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installing @telora/daemon when both Telora hook binaries are available on PATH.

Impact

Future Claude prompt and tool events are routed through the configured hooks; the inspected source does not establish whether those hooks disclose event contents.

Mechanism

The dependency postinstall adds the binaries to global Claude prompt-submit and post-tool hooks and writes the settings file.

Policy narrative

The package depends on @telora/mcp-products, whose postinstall runs automatically. When two Telora hook binaries are found on PATH, it adds them to global Claude prompt-submit and post-tool hooks and writes the settings file without an affirmative consent check. This alters a global agent control surface; the inspected source does not establish whether the hooks transmit event contents.

AI rationale

Evidence

package.json.lpm-dependency-evidence-74ea72eb-a88b-4d26-a03b-bc63f8013213/2/npm-linux/package.json.lpm-dependency-evidence-74ea72eb-a88b-4d26-a03b-bc63f8013213/2/npm-linux/scripts/postinstall.js.claude/settings.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

The package installs @telora/mcp-products as a dependency.
That dependency runs a postinstall script during installation.
The script proceeds when both Telora hook binaries are on PATH, with no consent check.
It writes those binaries into global Claude settings for prompt-submit and post-tool events.

Evidence against

The package itself has no preinstall, install, or postinstall hook.
The inspected source does not establish that the configured hooks transmit event contents.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 979 file(s), 7.43 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.openai.com, api.osv.dev, api.syntelyos.com, app.ledgerly.example, git.syntelyos.com, registry.npmjs.org, telora.syntelyos.com

Source & flagged code

19 flagged

dist/update/self-update.jsView file

Lines 1-47javascript

1// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)

2// Pinned by: packages/daemon/src/update/auto-update.test.ts,

3// packages/daemon/src/update/npx-run-guard.test.ts, packages/daemon/src/update/package-root-paths.test.ts,

4// packages/daemon/src/update/self-update.test.ts

5// PINNED-BY-END

6/**

7 * Self-update mechanism for the Telora daemon.

8 *

9 * Handles the full update lifecycle:

10 * 1. Detect installation mode (npm global, npx cache, or git source)

11 * 2. Dependency-ordered rebuild chain for git source mode

12 * 3. Pre-update snapshot for rollback

13 * 4. Update orchestration (stop engines, update, restart)

14 * 5. Version check and up-to-date detection

15 * 6. Migration auto-apply after update

16 *

17 * Three installation modes:

18 * - **npm**: Installed globally via `npm install -g @telora/daemon`.

19 * Updates via `npm install -g --@telora:registry=<channel> @telora/daemon@latest`

20 * (the update channel: npmjs unless TELORA_REGISTRY_URL overrides it).

21 * - **npx**: Running from an ephemeral npx cache (`~/.npm/_npx/<hash>/`).

22 * Self-update can't replace the running binary in place. The update path

23 * clears the npx cache and instructs the user to re-run via `npx`, which

24 * will then fetch the latest version. Auto-update is disabled.

25 * - **git**: Running from a git checkout (development mode).

26 * Updates via `git pull` + dependency-ordered rebuild.

27 */

28import { execFileSync, execFile } from 'node:child_process';

29import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/update/self-update.jsView on unpkg · L17

High

Child Process

Package source references child process execution.

dist/update/self-update.jsView on unpkg · L27

30import { dirname, resolve, join } from 'node:path';

31import { fileURLToPath } from 'node:url';

32import { checkForUpdates } from './version-check.js';

33import { resolveUpdateChannelUrl, scopedInstallArgs, scopedInstallCommand, } from '../config/update-channel.js';

34import { createLogger } from '../log/daemon-log.js';

35import { loadEnvConfig } from '@telora/daemon-core';

36const log = createLogger({ module: 'self-update' });

37// ---------------------------------------------------------------------------

38// Installation mode detection (TEL-1)

39// ---------------------------------------------------------------------------

40/**

41 * Detect whether the daemon is running from an npm global install,

42 * an ephemeral npx cache, or a git source checkout.

43 *

44 * Heuristics (in order):

45 * - Path contains `/_npx/` -> npx mode (ephemeral cache).

46 * - Source directory contains a `.git` directory (or a parent does) -> git mode.

47 * - Otherwise -> npm mode (global install, project node_modules, etc.).

•matchType = normalized_sha256 matchedPackage = @telora/daemon@0.24.29 matchedPath = dist/update/self-update.js matchedIdentity = npm:QHRlbG9yYS9kYWVtb24:0.24.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/update/self-update.jsView on unpkg

dist/verify/attribution/verification-baseline-run.js#virtual:normalized:round1View file

251// --------------------------------------------------------------------------- L252: /** Spawn `sh -c command` in cwd and capture the FULL combined stdout+stderr and how it ended. */ L253: export function runShellCapture(command, cwd, timeoutMs) {

High

Shell

Package source references shell execution.

dist/verify/attribution/verification-baseline-run.js#virtual:normalized:round1View on unpkg · L251

dist/completion/team-progress/team-progress-measure.jsView file

Lines 295-335javascript

295export function __resetTeamProgressMeasureForTesting() {

296 activityByFocus.clear();

297}

298/** Content of one worktree path for the fingerprint: its bytes, a symlink's target, or its absence. */

299function worktreePathContent(absPath) {

300

scripts/telora-daemon-wrapper.shView file

•path = scripts/telora-daemon-wrapper.sh kind = build_helper sizeBytes = 1248 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/telora-daemon-wrapper.shView on unpkg

dist/audit/audit-phase.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 43

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/audit/audit-phase.js#virtual:normalized:round1View on unpkg

dist/cli/connect/config-write.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/daemon@0.24.29 matchedPath = dist/cli/connect/config-write.js matchedIdentity = npm:QHRlbG9yYS9kYWVtb24:0.24.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/connect/config-write.jsView on unpkg

dist/cli/session-state.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/daemon@0.24.29 matchedPath = dist/cli/session-state.js matchedIdentity = npm:QHRlbG9yYS9kYWVtb24:0.24.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/session-state.jsView on unpkg

dist/composition/runtime-lacuna-context.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/daemon@0.24.29 matchedPath = dist/composition/runtime-lacuna-context.js matchedIdentity = npm:QHRlbG9yYS9kYWVtb24:0.24.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/composition/runtime-lacuna-context.jsView on unpkg

dist/daemon-state/daemon-process.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/daemon@0.24.29 matchedPath = dist/daemon-state/daemon-process.js matchedIdentity = npm:QHRlbG9yYS9kYWVtb24:0.24.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon-state/daemon-process.jsView on unpkg

dist/shell/unified-init.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/daemon@0.24.29 matchedPath = dist/shell/unified-init.js matchedIdentity = npm:QHRlbG9yYS9kYWVtb24:0.24.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/shell/unified-init.jsView on unpkg

dist/shell/update-restart.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/daemon@0.24.29 matchedPath = dist/shell/update-restart.js matchedIdentity = npm:QHRlbG9yYS9kYWVtb24:0.24.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/shell/update-restart.jsView on unpkg

dist/worktree/install-script-effects.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/daemon@0.24.29 matchedPath = dist/worktree/install-script-effects.js matchedIdentity = npm:QHRlbG9yYS9kYWVtb24:0.24.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/worktree/install-script-effects.jsView on unpkg

dist/worktree/worktree-package-provisioning.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/daemon@0.24.29 matchedPath = dist/worktree/worktree-package-provisioning.js matchedIdentity = npm:QHRlbG9yYS9kYWVtb24:0.24.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/worktree/worktree-package-provisioning.jsView on unpkg

dist/backends/lacuna/supervisor.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/daemon@0.24.29 matchedPath = dist/backends/lacuna/supervisor.js matchedIdentity = npm:QHRlbG9yYS9kYWVtb24:0.24.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/backends/lacuna/supervisor.jsView on unpkg

dist/cli/open.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/daemon@0.24.29 matchedPath = dist/cli/open.js matchedIdentity = npm:QHRlbG9yYS9kYWVtb24:0.24.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/open.jsView on unpkg

dist/composition/execution-spawn-context.jsView file

•matchType = normalized_sha256 matchedPackage = @telora/daemon@0.24.29 matchedPath = dist/composition/execution-spawn-context.js matchedIdentity = npm:QHRlbG9yYS9kYWVtb24:0.24.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/composition/execution-spawn-context.jsView on unpkg

package.jsonView file

•dependencies.@telora/mcp-products = ^0.23.16 previous = ^0.23.14 independentlyConfirmedMalicious = @telora/mcp-products@0.23.16 (lpm_ai_confirmed)

Critical

Known Malicious Dependency Insertion

A newly added or changed runtime dependency can resolve to an independently confirmed malicious package version.

package.jsonView on unpkg

Source & flagged code

19 flagged · loading source

dist/update/self-update.jsView file

27*/ L28: import { execFileSync, execFile } from 'node:child_process'; L29: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/update/self-update.jsView on unpkg · L27

17* Three installation modes: L18: * - **npm**: Installed globally via `npm install -g @telora/daemon`. L19: * Updates via `npm install -g --@telora:registry=<channel> @telora/daemon@latest` ... L27: */ L28: import { execFileSync, execFile } from 'node:child_process'; L29: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/update/self-update.jsView on unpkg · L17

High

Known Malware Source Similarity

Findings

1 Critical16 High4 Medium6 Low

CriticalKnown Malicious Dependency Insertionpackage.json

HighChild Processdist/update/self-update.js

HighShelldist/verify/attribution/verification-baseline-run.js#virtual:normalized:round1

HighRuntime Package Installdist/update/self-update.js

HighSemantic Analysis Limiteddist/audit/audit-phase.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/update/self-update.js

HighKnown Malware Source Similaritydist/cli/connect/config-write.js

HighKnown Malware Source Similaritydist/cli/session-state.js

HighKnown Malware Source Similaritydist/composition/runtime-lacuna-context.js

HighKnown Malware Source Similaritydist/daemon-state/daemon-process.js

Affected versions and remediation

This report applies to @telora/daemon@0.24.36.

The versions list below shows the verdict for each recorded version.

Avoid installing @telora/daemon@0.24.36. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-22 00:33:13.654Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

106 known versions

0.24.36latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedOct 22, 2026, 12:28 AM 0.24.29MaliciousSoft block: AI-agent control surfaceBlockPublishedOct 21, 2026, 1:53 PM 0.24.25SuspiciousAgent extension lifecycle riskWarnPublishedOct 20, 2026, 11:52 AM 0.24.16Manual Review—AllowUnder Review

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @telora

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

More from @telora

Other AI-agent control-surface risk packages

Source & flagged code