@telora/daemon@0.22.58

Agent orchestration daemon for Telora - spawns and manages Claude Code instances

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 459 file(s), 3.68 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.openai.com, api.osv.dev, api.syntelyos.com, registry.npmjs.org, telora.syntelyos.com

Source & flagged code

5 flagged

dist/update/self-update.jsView file

Lines 1-45javascript

1// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)

2// Pinned by: packages/daemon/src/update/npx-run-guard.test.ts,

3// packages/daemon/src/update/package-root-paths.test.ts, packages/daemon/src/update/self-update.test.ts

4// PINNED-BY-END

5/**

6 * Self-update mechanism for the Telora daemon.

7 *

8 * Handles the full update lifecycle:

9 * 1. Detect installation mode (npm global, npx cache, or git source)

10 * 2. Dependency-ordered rebuild chain for git source mode

11 * 3. Pre-update snapshot for rollback

12 * 4. Update orchestration (stop engines, update, restart)

13 * 5. Version check and up-to-date detection

14 * 6. Migration auto-apply after update

15 *

16 * Three installation modes:

17 * - **npm**: Installed globally via `npm install -g @telora/daemon`.

18 * Updates via `npm install -g @telora/daemon@latest`.

19 * - **npx**: Running from an ephemeral npx cache (`~/.npm/_npx/<hash>/`).

20 * Self-update can't replace the running binary in place. The update path

21 * clears the npx cache and instructs the user to re-run via `npx`, which

22 * will then fetch the latest version. Auto-update is disabled.

23 * - **git**: Running from a git checkout (development mode).

24 * Updates via `git pull` + dependency-ordered rebuild.

25 */

26import { execFileSync, execFile } from 'node:child_process';

27import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/update/self-update.jsView on unpkg · L16

High

Child Process

Package source references child process execution.

dist/update/self-update.jsView on unpkg · L25

28import { dirname, resolve, join } from 'node:path';

29import { fileURLToPath } from 'node:url';

30import { checkForUpdates } from './version-check.js';

31import { createLogger } from '../shell/log.js';

32import { loadEnvConfig } from '@telora/daemon-core';

33const log = createLogger({ module: 'self-update' });

34// ---------------------------------------------------------------------------

35// Installation mode detection (TEL-1)

36// ---------------------------------------------------------------------------

37/**

38 * Detect whether the daemon is running from an npm global install,

39 * an ephemeral npx cache, or a git source checkout.

40 *

41 * Heuristics (in order):

42 * - Path contains `/_npx/` -> npx mode (ephemeral cache).

43 * - Source directory contains a `.git` directory (or a parent does) -> git mode.

44 * - Otherwise -> npm mode (global install, project node_modules, etc.).

45 *

dist/verify/verification-baseline.jsView file

Lines 102-142javascript

102 const failing = [...parseFailingTests(output)];

103 deps.writeCache(productId, baseSha, failing);

104 return new Set(failing);

105}

106// ---------------------------------------------------------------------------

scripts/telora-daemon-wrapper.shView file

•path = scripts/telora-daemon-wrapper.sh kind = build_helper sizeBytes = 774 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/telora-daemon-wrapper.shView on unpkg

build-info.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 19

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build-info.jsonView on unpkg

Source & flagged code

5 flagged · loading source

dist/update/self-update.jsView file

25*/ L26: import { execFileSync, execFile } from 'node:child_process'; L27: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/update/self-update.jsView on unpkg · L25

16* Three installation modes: L17: * - **npm**: Installed globally via `npm install -g @telora/daemon`. L18: * Updates via `npm install -g @telora/daemon@latest`. ... L25: */ L26: import { execFileSync, execFile } from 'node:child_process'; L27: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/update/self-update.jsView on unpkg · L16

dist/verify/verification-baseline.jsView file

122} L123: /** Spawn `sh -c command` in cwd and capture the FULL combined stdout+stderr. */ L124: function runShellCapture(command, cwd, timeoutMs) {

Findings

4 High4 Medium5 Low

HighChild Processdist/update/self-update.js

HighShelldist/verify/verification-baseline.js

HighRuntime Package Installdist/update/self-update.js

HighSemantic Analysis Limitedbuild-info.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/telora-daemon-wrapper.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @telora/daemon@0.22.58.

See all versions of @telora/daemon for other recorded verdicts.

Review the evidence and your use of @telora/daemon@0.22.58 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 03:04:22.091Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @telora

Behavioral surface

Related packages

More from @telora

Source & flagged code