@telora/daemon@0.24.36
Agent orchestration daemon for Telora - spawns and manages Claude Code instances
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe dependency’s automatic postinstall modifies global Claude hook settings without affirmative consent, meeting the control-surface hijack criteria. The inspected source does not prove subsequent event-content transmission, so the finding is limited to the configuration change.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Installing @telora/daemon when both Telora hook binaries are available on PATH.
Impact
Future Claude prompt and tool events are routed through the configured hooks; the inspected source does not establish whether those hooks disclose event contents.
Mechanism
The dependency postinstall adds the binaries to global Claude prompt-submit and post-tool hooks and writes the settings file.
Policy narrative
The package depends on @telora/mcp-products, whose postinstall runs automatically. When two Telora hook binaries are found on PATH, it adds them to global Claude prompt-submit and post-tool hooks and writes the settings file without an affirmative consent check. This alters a global agent control surface; the inspected source does not establish whether the hooks transmit event contents.
AI rationale
The dependency’s automatic postinstall modifies global Claude hook settings without affirmative consent, meeting the control-surface hijack criteria. The inspected source does not prove subsequent event-content transmission, so the finding is limited to the configuration change.
Evidence
package.json.lpm-dependency-evidence-74ea72eb-a88b-4d26-a03b-bc63f8013213/2/npm-linux/package.json.lpm-dependency-evidence-74ea72eb-a88b-4d26-a03b-bc63f8013213/2/npm-linux/scripts/postinstall.js.claude/settings.json
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- The package installs @telora/mcp-products as a dependency.
- That dependency runs a postinstall script during installation.
- The script proceeds when both Telora hook binaries are on PATH, with no consent check.
- It writes those binaries into global Claude settings for prompt-submit and post-tool events.
Evidence against
- The package itself has no preinstall, install, or postinstall hook.
- The inspected source does not establish that the configured hooks transmit event contents.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
19 flagged · loading sourcedist/update/self-update.jsView file
27*/
L28: import { execFileSync, execFile } from 'node:child_process';
L29: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
High
Child Process
Package source references child process execution.
dist/update/self-update.jsView on unpkg · L2717* Three installation modes:
L18: * - **npm**: Installed globally via `npm install -g @telora/daemon`.
L19: * Updates via `npm install -g --@telora:registry=<channel> @telora/daemon@latest`
...
L27: */
L28: import { execFileSync, execFile } from 'node:child_process';
L29: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/update/self-update.jsView on unpkg · L17•matchType = normalized_sha256
matchedPackage = @telora/daemon@0.24.29
matchedPath = dist/update/self-update.js
matchedIdentity = npm:QHRlbG9yYS9kYWVtb24:0.24.29
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Findings
1 Critical16 High4 Medium6 Low
CriticalKnown Malicious Dependency Insertionpackage.json
HighChild Processdist/update/self-update.js
HighShelldist/verify/attribution/verification-baseline-run.js#virtual:normalized:round1
HighRuntime Package Installdist/update/self-update.js
HighSemantic Analysis Limiteddist/audit/audit-phase.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/update/self-update.js
HighKnown Malware Source Similaritydist/cli/connect/config-write.js
HighKnown Malware Source Similaritydist/cli/session-state.js
HighKnown Malware Source Similaritydist/composition/runtime-lacuna-context.js
HighKnown Malware Source Similaritydist/daemon-state/daemon-process.js
Affected versions and remediation
This report applies to @telora/daemon@0.24.36.
See all versions of @telora/daemon for other recorded verdicts.
- Avoid installing @telora/daemon@0.24.36. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.