@telora/daemon@0.22.293
Agent orchestration daemon for Telora - spawns and manages Claude Code instances
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe source supports a warning for explicit user-command mutation of agent configuration, including hook and MCP setup. I found no concrete malicious chain or install-time agent-control mutation.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the connect setup command.
Impact
This grants the configured Telora integration presence in the selected agent environment; the inspected evidence does not establish malicious control or credential theft.
Mechanism
The setup writes harness-specific configuration and agent instruction files, including a Claude settings hooks merge and MCP server registration.
AI rationale
The source supports a warning for explicit user-command mutation of agent configuration, including hook and MCP setup. I found no concrete malicious chain or install-time agent-control mutation.
Evidence
dist/cli/connect.jsdist/cli/connect/agents.jsdist/cli/connect/claude.jsdist/cli/connect/cline.jsdist/cli/connect/codex.jsdist/cli/connect/config-write.jsdist/cli/connect/gitignore-convergence.jsdist/cli/connect/ide.js
Decision evidence
public snapshotAI called this Suspicious at 79.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The connect flow writes agent instructions and harness configuration, including Claude settings hooks and MCP registrations, as part of an explicit CLI setup command.
- The repository root and daemon configuration are package-aligned setup destinations; no unconsented npm install hook is declared.
- The reviewed snippets show no confirmed credential exfiltration or attack.
Evidence against
- package.json declares only prepublishOnly, which builds and stamps package metadata; it has no preinstall, install, or postinstall hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcedist/update/self-update.jsView file
27*/
L28: import { execFileSync, execFile } from 'node:child_process';
L29: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
High
Child Process
Package source references child process execution.
dist/update/self-update.jsView on unpkg · L2717* Three installation modes:
L18: * - **npm**: Installed globally via `npm install -g @telora/daemon`.
L19: * Updates via `npm install -g --@telora:registry=<channel> @telora/daemon@latest`
...
L27: */
L28: import { execFileSync, execFile } from 'node:child_process';
L29: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/update/self-update.jsView on unpkg · L17dist/verify/attribution/verification-baseline-run.js#virtual:normalized:round1View file
Findings
1 Critical4 High4 Medium6 Low
CriticalKnown Malicious Dependency Insertionpackage.json
HighChild Processdist/update/self-update.js
HighShelldist/verify/attribution/verification-baseline-run.js#virtual:normalized:round1
HighRuntime Package Installdist/update/self-update.js
HighSemantic Analysis Limiteddist/audit/audit-phase.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/telora-daemon-wrapper.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/completion/team-progress/team-progress-measure.js
Affected versions and remediation
This report applies to @telora/daemon@0.22.293.
See all versions of @telora/daemon for other recorded verdicts.
- Review the evidence and your use of @telora/daemon@0.22.293 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.