registry / @telora/daemon / 0.22.87
@telora/daemon@0.22.87
Agent orchestration daemon for Telora - spawns and manages Claude Code instances
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package intentionally provisions and operates autonomous coding agents with broad project authority and a runtime self-update path. These are real lifecycle risks, but the source does not establish concrete malicious behavior in this release.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs connect, init, or the daemon against configured products.
Impact
A compromised Telora service or later package release could influence agent behavior and update the globally installed daemon; the code does not show direct credential theft.
Mechanism
Daemon-managed agent provisioning, runtime self-update, and autonomous worktree execution.
AI rationale
The package intentionally provisions and operates autonomous coding agents with broad project authority and a runtime self-update path. These are real lifecycle risks, but the source does not establish concrete malicious behavior in this release.
Evidence
dist/shell/unified-shell.jsdist/shell/unified-shell-provisioning.jsdist/worktree/provision.jsdist/update/auto-update.jsdist/cli/connect.js~/.codex/AGENTS.md<configured-repository>/.mcp.json<configured-repository>/AGENTS.md<daemon-worktree>/.codex/config.toml
Network endpoints1
api.syntelyos.com
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The running daemon refreshes an existing global Codex instruction file and configured repositories' AGENTS.md files at boot.
- It creates a worktree-local Codex configuration that disables approval prompts and permits workspace writes.
- Its auto-update loop installs the latest package globally during daemon runtime.
- The connect command sends a user-supplied connection token to the configured Telora endpoint and can start the daemon in the background.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The package does not depend on its own package name.
- The network connection and setup actions are reached through explicit CLI setup commands; no secret harvesting or unrelated exfiltration was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcedist/update/self-update.jsView file
25*/
L26: import { execFileSync, execFile } from 'node:child_process';
L27: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
High
Child Process
Package source references child process execution.
dist/update/self-update.jsView on unpkg · L2516* Three installation modes:
L17: * - **npm**: Installed globally via `npm install -g @telora/daemon`.
L18: * Updates via `npm install -g @telora/daemon@latest`.
...
L25: */
L26: import { execFileSync, execFile } from 'node:child_process';
L27: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/update/self-update.jsView on unpkg · L16dist/verify/verification-baseline.jsView file
122}
L123: /** Spawn `sh -c command` in cwd and capture the FULL combined stdout+stderr. */
L124: function runShellCapture(command, cwd, timeoutMs) {
Findings
2 Critical4 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/spawn/routing-decider.js
CriticalKnown Malicious Dependency Insertionpackage.json
HighChild Processdist/update/self-update.js
HighShelldist/verify/verification-baseline.js
HighRuntime Package Installdist/update/self-update.js
HighSemantic Analysis Limitedbuild-info.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/telora-daemon-wrapper.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to @telora/daemon@0.22.87.
See all versions of @telora/daemon for other recorded verdicts.
- Review the evidence and your use of @telora/daemon@0.22.87 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.