registry / @telora/daemon / 0.21.196
@telora/daemon@0.21.196
Agent orchestration daemon for Telora - spawns and manages Claude Code instances
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe source shows a configuration-gated sidecar installer that can update and execute code from a configured Git source. This supports a warning about conditional extension lifecycle risk, not a finding of malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Daemon startup with Lacuna enabled and a missing sidecar virtual environment.
Impact
A changed or compromised configured source could run code with the daemon user’s permissions; the inspected package source does not establish a malicious payload.
Mechanism
The daemon resolves the configured source, fetches and checks out Git revisions when applicable, installs the source, and launches the sidecar process.
AI rationale
The source shows a configuration-gated sidecar installer that can update and execute code from a configured Git source. This supports a warning about conditional extension lifecycle risk, not a finding of malicious behavior.
Evidence
dist/shell/unified-shell.jsdist/backends/lacuna/lifecycle.jsdist/backends/lacuna/supervisor.jsdist/backends/lacuna/launch-adapter.js
Decision evidence
public snapshotAI called this Suspicious at 80.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Daemon startup can start the Lacuna sidecar when Lacuna is enabled; the installer requires a configured source if its virtual environment is missing.
- For an existing Git checkout, the install plan fetches updates and force-checks out the configured ref or the remote default branch, then installs and launches the sidecar as a child process.
- The sidecar source and install behavior are conditional on configuration; the package manifest shows only a prepublishOnly lifecycle script.
- The unresolved spawn lifecycle operation closes a merge session after resolution; it does not show an account action.
Evidence against
- No malicious behavior was established in the inspected source; the sidecar source is selected through Lacuna configuration.
- The manifest’s prepublishOnly script builds and stamps package metadata; it is not an npm install hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
6 flagged · loading sourcedist/update/self-update.jsView file
25*/
L26: import { execFileSync, execFile } from 'node:child_process';
L27: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
High
Child Process
Package source references child process execution.
dist/update/self-update.jsView on unpkg · L2516* Three installation modes:
L17: * - **npm**: Installed globally via `npm install -g @telora/daemon`.
L18: * Updates via `npm install -g @telora/daemon@latest`.
...
L25: */
L26: import { execFileSync, execFile } from 'node:child_process';
L27: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/update/self-update.jsView on unpkg · L16dist/verify/verification-baseline.jsView file
116}
L117: /** Spawn `sh -c command` in cwd and capture the FULL combined stdout+stderr. */
L118: function runShellCapture(command, cwd, timeoutMs) {
Findings
1 Critical4 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/backends/lacuna/supervisor.js
HighChild Processdist/update/self-update.js
HighShelldist/verify/verification-baseline.js
HighRuntime Package Installdist/update/self-update.js
HighSemantic Analysis Limitedbuild-info.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/telora-daemon-wrapper.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @telora/daemon@0.21.196.
See all versions of @telora/daemon for other recorded verdicts.
- Review the evidence and your use of @telora/daemon@0.21.196 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.