@telora/daemon@0.22.72
Agent orchestration daemon for Telora - spawns and manages Claude Code instances
AI Security Review
scanned 1mo ago · by lpm-firewall-aiNo malicious npm lifecycle chain or secret-exfiltration behavior was found. The package nevertheless has explicit persistent agent-extension and sidecar-execution capabilities that warrant a warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs telora-daemon connect, or starts the daemon with a Lacuna source configured.
Impact
The package can extend local AI-agent tool and hook surfaces and execute a configured sidecar.
Mechanism
User-invoked agent configuration mutation and configured sidecar installation.
AI rationale
No malicious npm lifecycle chain or secret-exfiltration behavior was found. The package nevertheless has explicit persistent agent-extension and sidecar-execution capabilities that warrant a warning.
Evidence
dist/cli/connect.jsdist/cli/connect/codex.jsdist/backends/lacuna/launch-adapter.js~/.codex/config.toml~/.claude/settings.json~/.telora/lacuna/src~/.telora/lacuna/venv
Network endpoints2
api.syntelyos.comapi.anthropic.com
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit connect command registers a Telora MCP server in the operator's personal Codex configuration.
- The connect flow can merge Telora tracking hooks into the user's Claude settings when a companion executable is present.
- The daemon can fetch a configured Git source, install it into a virtual environment, and launch it as a sidecar.
- The package has no npm install lifecycle hook; its only lifecycle script is prepublishOnly.
Evidence against
- The configuration and hook writes occur only after the user invokes the connect command.
- The observed network request redeems a user-supplied connect token against the Telora service.
- No source evidence showed credential harvesting, secret exfiltration, hidden install-time execution, or self-dependency.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcedist/update/self-update.jsView file
25*/
L26: import { execFileSync, execFile } from 'node:child_process';
L27: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
High
Child Process
Package source references child process execution.
dist/update/self-update.jsView on unpkg · L2516* Three installation modes:
L17: * - **npm**: Installed globally via `npm install -g @telora/daemon`.
L18: * Updates via `npm install -g @telora/daemon@latest`.
...
L25: */
L26: import { execFileSync, execFile } from 'node:child_process';
L27: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/update/self-update.jsView on unpkg · L16dist/verify/verification-baseline.jsView file
122}
L123: /** Spawn `sh -c command` in cwd and capture the FULL combined stdout+stderr. */
L124: function runShellCapture(command, cwd, timeoutMs) {
Findings
2 Critical4 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/backends/lacuna/supervisor.js
CriticalKnown Malicious Dependency Insertionpackage.json
HighChild Processdist/update/self-update.js
HighShelldist/verify/verification-baseline.js
HighRuntime Package Installdist/update/self-update.js
HighSemantic Analysis Limitedbuild-info.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/telora-daemon-wrapper.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @telora/daemon@0.22.72.
See all versions of @telora/daemon for other recorded verdicts.
- Review the evidence and your use of @telora/daemon@0.22.72 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.