@telora/daemon@0.22.97
Agent orchestration daemon for Telora - spawns and manages Claude Code instances
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package has risky automatic update and explicit AI-agent setup capabilities, but source inspection found no npm install lifecycle abuse or concrete malicious payload. Its behavior warrants a warning for user-level agent control-surface mutation and automatic replacement of the running daemon.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Run the daemon with automatic updates enabled, or explicitly run the connect flow with an agent harness.
Impact
A registry update can replace the globally installed daemon, and explicit setup can cause future agent sessions to load Telora configuration or execute Telora hook binaries.
Mechanism
Automatic self-update and user-level AI-agent configuration mutation.
AI rationale
The package has risky automatic update and explicit AI-agent setup capabilities, but source inspection found no npm install lifecycle abuse or concrete malicious payload. Its behavior warrants a warning for user-level agent control-surface mutation and automatic replacement of the running daemon.
Evidence
dist/update/self-update.jsdist/shell/unified-shell.jsdist/cli/connect/codex.jsdist/cli/connect/registration.js$HOME/.codex/config.toml$HOME/.claude/settings.jsonglobal npm installation prefix
Network endpoints2
registry.npmjs.org/api.syntelyos.com
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Unknown with low false-positive risk.
Evidence for warning
- The running daemon automatically installs the latest release of its own package when an update is available.
- The automatic update loop is enabled during daemon runtime unless the operator disables it.
- The explicit connect flow writes a Telora MCP registration into the user's Codex configuration.
- The explicit connect flow can add command hooks to the user's Claude settings.
Evidence against
- package.json has no preinstall, install, or postinstall hook; its only lifecycle script is prepublishOnly.
- The agent configuration changes occur in explicit CLI setup flows, not during npm installation.
- The inspected network use targets the Telora API and npm registry; no secret-harvesting or unrelated exfiltration was found.
- The package does not runtime-depend on itself.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcedist/update/self-update.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @telora/daemon@0.22.87
matchedIdentity = npm:QHRlbG9yYS9kYWVtb24:0.22.87
similarity = 0.842
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/update/self-update.jsView on unpkg27*/
L28: import { execFileSync, execFile } from 'node:child_process';
L29: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
High
Child Process
Package source references child process execution.
dist/update/self-update.jsView on unpkg · L2717* Three installation modes:
L18: * - **npm**: Installed globally via `npm install -g @telora/daemon`.
L19: * Updates via `npm install -g --@telora:registry=<channel> @telora/daemon@latest`
...
L27: */
L28: import { execFileSync, execFile } from 'node:child_process';
L29: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
High
Findings
2 Critical4 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/update/self-update.js
CriticalKnown Malicious Dependency Insertionpackage.json
HighChild Processdist/update/self-update.js
HighShelldist/verify/verification-baseline.js
HighRuntime Package Installdist/update/self-update.js
HighSemantic Analysis Limitedbuild-info.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/telora-daemon-wrapper.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to @telora/daemon@0.22.97.
See all versions of @telora/daemon for other recorded verdicts.
- Review the evidence and your use of @telora/daemon@0.22.97 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.