registry / @telora/daemon / 0.20.2
@telora/daemon@0.20.2
⚠ Under reviewAgent orchestration daemon for Telora - spawns and manages Claude Code instances
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/unified-shell.jsView file
27import { fileURLToPath } from 'node:url';
L28: import { spawn, execFileSync } from 'node:child_process';
L29: import { loadUnifiedConfig, loadEnvConfig, acquirePidLock, releasePidLock, PidLockError, } from '@telora/daemon-core';
High
Child Process
Package source references child process execution.
dist/unified-shell.jsView on unpkg · L27dist/cli/verify-setup.jsView file
137return new Promise((res) => {
L138: const child = spawn(command, { cwd: repoPath, shell: true, stdio: 'inherit' });
L139: child.on('close', (code) => res({ exitCode: code ?? 1, durationMs: Date.now() - startedAt }));
High
dist/self-update.jsView file
Findings
1 Critical3 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/cli/connect.js
HighChild Processdist/unified-shell.js
HighShelldist/cli/verify-setup.js
HighRuntime Package Installdist/self-update.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/telora-daemon-wrapper.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @telora/daemon@0.20.2.
See all versions of @telora/daemon for other recorded verdicts.
- Review the evidence and your use of @telora/daemon@0.20.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.