@telora/daemon@0.24.15

⚠ Under review

Agent orchestration daemon for Telora - spawns and manages Claude Code instances

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The inspected source does not establish malicious behavior, and the flagged npm operations appear in update and worktree provisioning paths. A package-wide clean verdict requires more distinct source citations than the output permits, so the result remains unresolved.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The inspected setup runs through the explicit connect command; update and dependency provisioning are separate runtime operations.

Impact

The inspected behavior supports setup and dependency maintenance; it does not establish an attack.

Mechanism

The reviewed code writes connection and agent setup, runs npm for updates, and provisions worktree dependencies.

AI rationale

Evidence

package.jsondist/index.jsdist/cli/connect.jsdist/cli/connect/agents.jsdist/update/self-update.jsdist/worktree/worktree-package-provisioning.js

Decision evidence

public snapshot

AI called this Manual Review at 68.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest’s inspected publish hooks run build and documentation-copy tasks; it shows no install lifecycle hook.
The CLI exposes configuration and agent scaffolding through the explicit connect command.
The inspected npm invocation is in the update module; worktree provisioning also contains an npm installer.

Evidence against

The connect flow redeems a token before writing setup configuration and agent scaffolding.
The inspected source does not establish unconsented credential transfer or a malicious payload.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 929 file(s), 7.03 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.openai.com, api.osv.dev, api.syntelyos.com, app.ledgerly.example, registry.npmjs.org, telora.syntelyos.com

Source & flagged code

7 flagged

dist/update/self-update.jsView file

Lines 1-47javascript

1// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)

2// Pinned by: packages/daemon/src/update/auto-update.test.ts,

3// packages/daemon/src/update/npx-run-guard.test.ts, packages/daemon/src/update/package-root-paths.test.ts,

4// packages/daemon/src/update/self-update.test.ts

5// PINNED-BY-END

6/**

7 * Self-update mechanism for the Telora daemon.

8 *

9 * Handles the full update lifecycle:

10 * 1. Detect installation mode (npm global, npx cache, or git source)

11 * 2. Dependency-ordered rebuild chain for git source mode

12 * 3. Pre-update snapshot for rollback

13 * 4. Update orchestration (stop engines, update, restart)

14 * 5. Version check and up-to-date detection

15 * 6. Migration auto-apply after update

16 *

17 * Three installation modes:

18 * - **npm**: Installed globally via `npm install -g @telora/daemon`.

19 * Updates via `npm install -g --@telora:registry=<channel> @telora/daemon@latest`

20 * (the update channel: npmjs unless TELORA_REGISTRY_URL overrides it).

21 * - **npx**: Running from an ephemeral npx cache (`~/.npm/_npx/<hash>/`).

22 * Self-update can't replace the running binary in place. The update path

23 * clears the npx cache and instructs the user to re-run via `npx`, which

24 * will then fetch the latest version. Auto-update is disabled.

25 * - **git**: Running from a git checkout (development mode).

26 * Updates via `git pull` + dependency-ordered rebuild.

27 */

28import { execFileSync, execFile } from 'node:child_process';

29import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/update/self-update.jsView on unpkg · L17

High

Child Process

Package source references child process execution.

dist/update/self-update.jsView on unpkg · L27

30import { dirname, resolve, join } from 'node:path';

31import { fileURLToPath } from 'node:url';

32import { checkForUpdates } from './version-check.js';

33import { resolveUpdateChannelUrl, scopedInstallArgs, scopedInstallCommand, } from '../config/update-channel.js';

34import { createLogger } from '../log/daemon-log.js';

35import { loadEnvConfig } from '@telora/daemon-core';

36const log = createLogger({ module: 'self-update' });

37// ---------------------------------------------------------------------------

38// Installation mode detection (TEL-1)

39// ---------------------------------------------------------------------------

40/**

41 * Detect whether the daemon is running from an npm global install,

42 * an ephemeral npx cache, or a git source checkout.

43 *

44 * Heuristics (in order):

45 * - Path contains `/_npx/` -> npx mode (ephemeral cache).

46 * - Source directory contains a `.git` directory (or a parent does) -> git mode.

47 * - Otherwise -> npm mode (global install, project node_modules, etc.).

dist/verify/attribution/verification-baseline-run.js#virtual:normalized:round1View file

250// --------------------------------------------------------------------------- L251: /** Spawn `sh -c command` in cwd and capture the FULL combined stdout+stderr and how it ended. */ L252: export function runShellCapture(command, cwd, timeoutMs) {

High

Shell

Package source references shell execution.

dist/verify/attribution/verification-baseline-run.js#virtual:normalized:round1View on unpkg · L250

dist/completion/team-progress/team-progress-measure.jsView file

Lines 295-335javascript

295export function __resetTeamProgressMeasureForTesting() {

296 activityByFocus.clear();

297}

298/** Content of one worktree path for the fingerprint: its bytes, a symlink's target, or its absence. */

299function worktreePathContent(absPath) {

300

scripts/telora-daemon-wrapper.shView file

•path = scripts/telora-daemon-wrapper.sh kind = build_helper sizeBytes = 774 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/telora-daemon-wrapper.shView on unpkg

dist/audit/audit-phase.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 38

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/audit/audit-phase.js#virtual:normalized:round1View on unpkg

dist/composition/verification-context.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @telora/daemon@0.24.7 matchedIdentity = npm:QHRlbG9yYS9kYWVtb24:0.24.7 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/composition/verification-context.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/update/self-update.jsView file

27*/ L28: import { execFileSync, execFile } from 'node:child_process'; L29: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/update/self-update.jsView on unpkg · L27

17* Three installation modes: L18: * - **npm**: Installed globally via `npm install -g @telora/daemon`. L19: * Updates via `npm install -g --@telora:registry=<channel> @telora/daemon@latest` ... L27: */ L28: import { execFileSync, execFile } from 'node:child_process'; L29: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/update/self-update.jsView on unpkg · L17

dist/verify/attribution/verification-baseline-run.js#virtual:normalized:round1View file

Findings

1 Critical4 High4 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/composition/verification-context.js

HighChild Processdist/update/self-update.js

HighShelldist/verify/attribution/verification-baseline-run.js#virtual:normalized:round1

HighRuntime Package Installdist/update/self-update.js

HighSemantic Analysis Limiteddist/audit/audit-phase.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/telora-daemon-wrapper.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/completion/team-progress/team-progress-measure.js

Affected versions and remediation

This report applies to @telora/daemon@0.24.15.

See all versions of @telora/daemon for other recorded verdicts.

Review the evidence and your use of @telora/daemon@0.24.15 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 03:42:37.280Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @telora

Behavioral surface

Related packages

More from @telora

Source & flagged code