@telora/daemon@0.23.57

Agent orchestration daemon for Telora - spawns and manages Claude Code instances

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Source inspection found no malicious behavior. The flagged lifecycle, shell, and package-manager signals correspond to a publish-time build script, Git verification and update operations, and worktree provisioning; agent hook configuration is reached through connect setup.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

An operator runs setup, update, or daemon-managed worktree provisioning.

Impact

No unauthorized credential transfer, broad agent control change, or destructive consumer mutation was established.

Mechanism

The package writes Telora-related configuration and hooks, installs dependencies in selected package directories, and performs Git operations for updates and verification.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes the daemon CLI, has only a prepublishOnly build-and-stamp lifecycle script, and has no dependency on itself.
The connect flow performs workstation tracking only when telora-ai is found; it merges Telora hook entries into the user's Claude settings while preserving existing configuration.
The configuration writers create or merge Telora-related files and ignore entries for managed products; the worktree hook writes a scoped read-only deny overlay.
Worktree npm ci runs in a selected package directory, while Lacuna setup requires a configured source before building an install plan.
Self-update code uses its detected install mode, and Git-source updates pull and install within the detected checkout.
The flagged verification shell operation reads a Git object, and the audit phase limits its assessor to an allowlisted set of Telora MCP tools.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Source & flagged code

8 flagged

dist/update/self-update.jsView file

Lines 1-47javascript

1// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)

2// Pinned by: packages/daemon/src/update/auto-update.test.ts,

3// packages/daemon/src/update/npx-run-guard.test.ts, packages/daemon/src/update/package-root-paths.test.ts,

4// packages/daemon/src/update/self-update.test.ts

5// PINNED-BY-END

6/**

7 * Self-update mechanism for the Telora daemon.

8 *

9 * Handles the full update lifecycle:

10 * 1. Detect installation mode (npm global, npx cache, or git source)

11 * 2. Dependency-ordered rebuild chain for git source mode

12 * 3. Pre-update snapshot for rollback

13 * 4. Update orchestration (stop engines, update, restart)

14 * 5. Version check and up-to-date detection

15 * 6. Migration auto-apply after update

16 *

17 * Three installation modes:

18 * - **npm**: Installed globally via `npm install -g @telora/daemon`.

19 * Updates via `npm install -g --@telora:registry=<channel> @telora/daemon@latest`

20 * (the update channel: npmjs unless TELORA_REGISTRY_URL overrides it).

21 * - **npx**: Running from an ephemeral npx cache (`~/.npm/_npx/<hash>/`).

22 * Self-update can't replace the running binary in place. The update path

23 * clears the npx cache and instructs the user to re-run via `npx`, which

24 * will then fetch the latest version. Auto-update is disabled.

25 * - **git**: Running from a git checkout (development mode).

26 * Updates via `git pull` + dependency-ordered rebuild.

27 */

28import { execFileSync, execFile } from 'node:child_process';

29import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/update/self-update.jsView on unpkg · L17

High

Child Process

Package source references child process execution.

dist/update/self-update.jsView on unpkg · L27

30import { dirname, resolve, join } from 'node:path';

31import { fileURLToPath } from 'node:url';

32import { checkForUpdates } from './version-check.js';

33import { resolveUpdateChannelUrl, scopedInstallArgs, scopedInstallCommand, } from '../config/update-channel.js';

34import { createLogger } from '../log/daemon-log.js';

35import { loadEnvConfig } from '@telora/daemon-core';

36const log = createLogger({ module: 'self-update' });

37// ---------------------------------------------------------------------------

38// Installation mode detection (TEL-1)

39// ---------------------------------------------------------------------------

40/**

41 * Detect whether the daemon is running from an npm global install,

42 * an ephemeral npx cache, or a git source checkout.

43 *

44 * Heuristics (in order):

45 * - Path contains `/_npx/` -> npx mode (ephemeral cache).

46 * - Source directory contains a `.git` directory (or a parent does) -> git mode.

47 * - Otherwise -> npm mode (global install, project node_modules, etc.).

dist/verify/attribution/verification-baseline-run.js#virtual:normalized:round1View file

250// --------------------------------------------------------------------------- L251: /** Spawn `sh -c command` in cwd and capture the FULL combined stdout+stderr and how it ended. */ L252: export function runShellCapture(command, cwd, timeoutMs) {

High

Shell

Package source references shell execution.

dist/verify/attribution/verification-baseline-run.js#virtual:normalized:round1View on unpkg · L250

dist/completion/team-progress/team-progress-measure.jsView file

Lines 295-335javascript

295export function __resetTeamProgressMeasureForTesting() {

296 activityByFocus.clear();

297}

298/** Content of one worktree path for the fingerprint: its bytes, a symlink's target, or its absence. */

299function worktreePathContent(absPath) {

300

scripts/telora-daemon-wrapper.shView file

•path = scripts/telora-daemon-wrapper.sh kind = build_helper sizeBytes = 774 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/telora-daemon-wrapper.shView on unpkg

dist/audit/audit-phase.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 39

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/audit/audit-phase.js#virtual:normalized:round1View on unpkg

dist/worktree/worktree-package-provisioning.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @telora/daemon@0.23.5 matchedIdentity = npm:QHRlbG9yYS9kYWVtb24:0.23.5 similarity = 0.792 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/worktree/worktree-package-provisioning.jsView on unpkg

package.jsonView file

•dependencies.@telora/mcp-products = ^0.22.182 previous = ^0.22.181 independentlyConfirmedMalicious = @telora/mcp-products@0.22.182 (lpm_ai_confirmed)

Critical

Known Malicious Dependency Insertion

A newly added or changed runtime dependency can resolve to an independently confirmed malicious package version.

package.jsonView on unpkg

Source & flagged code

8 flagged · loading source

dist/update/self-update.jsView file

27*/ L28: import { execFileSync, execFile } from 'node:child_process'; L29: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/update/self-update.jsView on unpkg · L27

17* Three installation modes: L18: * - **npm**: Installed globally via `npm install -g @telora/daemon`. L19: * Updates via `npm install -g --@telora:registry=<channel> @telora/daemon@latest` ... L27: */ L28: import { execFileSync, execFile } from 'node:child_process'; L29: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/update/self-update.jsView on unpkg · L17

dist/verify/attribution/verification-baseline-run.js#virtual:normalized:round1View file

Findings

2 Critical4 High4 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/worktree/worktree-package-provisioning.js

CriticalKnown Malicious Dependency Insertionpackage.json

HighChild Processdist/update/self-update.js

HighShelldist/verify/attribution/verification-baseline-run.js#virtual:normalized:round1

HighRuntime Package Installdist/update/self-update.js

HighSemantic Analysis Limiteddist/audit/audit-phase.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/telora-daemon-wrapper.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

Affected versions and remediation

This report applies to @telora/daemon@0.23.57.

See all versions of @telora/daemon for other recorded verdicts.

Review the evidence and your use of @telora/daemon@0.23.57 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 14:26:49.294Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @telora

Behavioral surface

Related packages

More from @telora

Source & flagged code