registry / @telora/daemon / 0.21.198
@telora/daemon@0.21.198
Agent orchestration daemon for Telora - spawns and manages Claude Code instances
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe scanner's execution and shell signals correspond to product functions, and the manifest has no install hook. I classify the first-party agent configuration and automatic settings refresh as a warning-level extension lifecycle capability; the inspected source does not support blocking the package.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The operator runs the connect setup and starts the configured daemon; the settings refresh then runs on daemon startup.
Impact
The package's own integration can run at agent session start and its configuration can be refreshed automatically. The inspected behavior does not establish credential theft, broad control hijacking, or malicious execution.
Mechanism
Setup writes harness-specific MCP and instruction configuration. Claude settings include a SessionStart command that invokes the package's session-state command.
AI rationale
The scanner's execution and shell signals correspond to product functions, and the manifest has no install hook. I classify the first-party agent configuration and automatic settings refresh as a warning-level extension lifecycle capability; the inspected source does not support blocking the package.
Evidence
dist/cli/connect.jsdist/cli/connect/agents.jsdist/cli/connect/claude.jsdist/cli/connect/cline.jsdist/cli/connect/codex.jsdist/cli/connect/config-write.jsdist/cli/connect/ide.jsdist/shell/unified-shell-provisioning.jsdist/templates/claude-settings.jsrepo/.claude/settings.jsonrepo/.mcp.json~/.codex/AGENTS.md~/.codex/config.toml~/.cline/data/settings/cline_mcp_settings.json.cursor/mcp.json.vscode/mcp.json
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The Claude, Codex, Cline, Cursor, and VS Code setup writes agent or MCP configuration, including files that agent clients load.
- Daemon startup refreshes configured products' Claude settings, and those settings include a SessionStart hook that runs telora-daemon session-state.
- The manifest's prepublishOnly script builds and stamps metadata; it is not an install lifecycle hook.
Evidence against
- The connect flow performs the setup and starts the daemon; the inspected configuration writes are part of this explicit product setup.
- The hook invokes the package's own daemon command, and the inspected runtime-operation hints concern merge resolution and installing a configured sidecar.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcedist/update/self-update.jsView file
25*/
L26: import { execFileSync, execFile } from 'node:child_process';
L27: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
High
Child Process
Package source references child process execution.
dist/update/self-update.jsView on unpkg · L2516* Three installation modes:
L17: * - **npm**: Installed globally via `npm install -g @telora/daemon`.
L18: * Updates via `npm install -g @telora/daemon@latest`.
...
L25: */
L26: import { execFileSync, execFile } from 'node:child_process';
L27: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/update/self-update.jsView on unpkg · L16dist/verify/verification-baseline.jsView file
116}
L117: /** Spawn `sh -c command` in cwd and capture the FULL combined stdout+stderr. */
L118: function runShellCapture(command, cwd, timeoutMs) {
Findings
1 Critical4 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/shell/unified-shell.js
HighChild Processdist/update/self-update.js
HighShelldist/verify/verification-baseline.js
HighRuntime Package Installdist/update/self-update.js
HighSemantic Analysis Limitedbuild-info.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/telora-daemon-wrapper.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @telora/daemon@0.21.198.
See all versions of @telora/daemon for other recorded verdicts.
- Review the evidence and your use of @telora/daemon@0.21.198 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.