registry / @telora/daemon / 0.22.160
@telora/daemon@0.22.160
Agent orchestration daemon for Telora - spawns and manages Claude Code instances
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe source shows explicit initial setup followed by automatic maintenance of a Claude agent hook across daemon starts. That first-party extension lifecycle creates a concrete residual risk, but the inspected behavior does not support blocking the package as malicious.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Starting the daemon with configured product repositories.
Impact
This can change agent behavior on later Claude sessions without a new connect command; the inspected hook runs the package's session-state command.
Mechanism
The daemon merges Telora settings and a hook that runs its session-state command into each configured repository's Claude settings.
AI rationale
The source shows explicit initial setup followed by automatic maintenance of a Claude agent hook across daemon starts. That first-party extension lifecycle creates a concrete residual risk, but the inspected behavior does not support blocking the package as malicious.
Evidence
dist/shell/unified-shell.jsdist/shell/unified-shell-provisioning.jsdist/cli/connect/claude.jsdist/templates/claude-settings.jsdist/index.js.claude/settings.json
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI exposes agent setup through an explicit connect command that redeems a user-provided token and writes harness scaffolding.
- Daemon startup refreshes Claude settings for configured product repositories.
- The refresh merges Telora permissions and a SessionStart hook into each product repository's Claude settings.
- The added hook invokes the daemon's session-state command during Claude session startup.
- The agent configuration paths inspected contain harness-specific setup for Claude, Codex, Cline, and IDEs.
- The manifest's prepublishOnly script runs build steps; it declares no install lifecycle hook.
Evidence against
- The initial configuration flow is an explicit connect command using a Telora token.
- The automatic settings refresh iterates repositories already listed in the daemon's product configuration.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
6 flagged · loading sourcedist/update/self-update.jsView file
27*/
L28: import { execFileSync, execFile } from 'node:child_process';
L29: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
High
Child Process
Package source references child process execution.
dist/update/self-update.jsView on unpkg · L2717* Three installation modes:
L18: * - **npm**: Installed globally via `npm install -g @telora/daemon`.
L19: * Updates via `npm install -g --@telora:registry=<channel> @telora/daemon@latest`
...
L27: */
L28: import { execFileSync, execFile } from 'node:child_process';
L29: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/update/self-update.jsView on unpkg · L17dist/verify/verification-baseline-run.js#virtual:normalized:round1View file
Findings
1 Critical4 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/shell/unified-shell.js
HighChild Processdist/update/self-update.js
HighShelldist/verify/verification-baseline-run.js#virtual:normalized:round1
HighRuntime Package Installdist/update/self-update.js
HighSemantic Analysis Limiteddist/audit/audit-phase.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/telora-daemon-wrapper.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @telora/daemon@0.22.160.
See all versions of @telora/daemon for other recorded verdicts.
- Review the evidence and your use of @telora/daemon@0.22.160 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.