registry / daedalus-cli / 1.36.1

daedalus-cli@1.36.1

Local-first AI coding CLI with embedded model router, multi-agent orchestration, and codebase indexing

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found by source inspection. Risky primitives are expected for a local AI coding CLI and are activated by user CLI interaction or explicit configuration.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install postinstall; user invokes daedalus and requests tools or enables config flags

Impact

No credential harvesting, exfiltration, destructive persistence, dependency confusion, or unconsented lifecycle AI-agent control mutation confirmed.

Mechanism

local config setup plus user-invoked terminal, file, web, model, and MCP tooling

Rationale

The lifecycle hook is benign local setup, and the suspicious shell/network/file primitives are documented runtime features of the CLI with approval/sanitization controls. No source evidence showed install-time payload download, credential theft, exfiltration, persistence, or hidden destructive behavior.

Evidence

package.jsonscripts/postinstall.jsdist/index.jsdist/model.jsdist/tools/builtin/terminal.jsdist/tools/builtin/files.jsdist/tools/mcp/stdio.jsdist/update-check.jsdist/tools/builtin/web.jsdist/tools/mcp/manager.js~/.daedalus~/.daedalus/config.json~/.daedalus/indexing/*.sqlite~/.daedalus/screenshots/*.png

Network endpoints11

registry.npmjs.org/daedalus-cli/latesthtml.duckduckgo.com/html/registry.modelcontextprotocol.iolocalhost:1234localhost:11434localhost:8080localhost:8000api.openai.com/v1api.groq.com/openai/v1openrouter.ai/api/v1api.anthropic.com/v1

Decision evidence

public snapshot

AI called this Clean at 87.0% confidence as Benign with medium false-positive risk.

Evidence for block

package.json defines postinstall lifecycle script scripts/postinstall.js.
dist/tools/builtin/terminal.js and files.js expose user-invoked shell/write capabilities for an AI coding CLI.
dist/index.js system prompt encourages tool use, including installs, but runtime approval gates exist unless auto-approve is configured.

Evidence against

scripts/postinstall.js only creates ~/.daedalus; no fetch, spawn, or payload execution.
dist/tools/builtin/terminal.js strips common secret env vars and blocks install commands without approval unless DAEDALUS_ALLOW_INSTALL=true.
dist/model.js gates terminal/write_file unless DAEDALUS_AUTO_APPROVE is enabled by user/config.
dist/tools/mcp/stdio.js sanitizes env and rejects shell metacharacters in configured MCP commands.
Network calls are package-aligned: update checks, user-requested web fetch/search, model/router health, MCP registry/configured servers.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 106 file(s), 807 KB of source, external domains: api.anthropic.com, api.groq.com, api.openai.com, api.primary.ai, api.secondary.ai, bgill55.github.io, example.com, html.duckduckgo.com, openrouter.ai, registry.modelcontextprotocol.io, registry.npmjs.org

Source & flagged code

9 flagged

package.jsonView file

Lines 8-48json

8 },

9 "files": [

10 "dist/",

11 "Daedalus.bat",

12 "README.md",

13 "CHANGELOG.md",

14 "CONTRIBUTING.md",

15 "CODE_OF_CONDUCT.md",

16 "SECURITY.md",

17 "AGENTS.md",

18 "scripts/postinstall.js"

19 ],

20 "scripts": {

21 "start": "tsx src/index.ts",

22 "dev": "tsx watch src/index.ts",

23 "build": "tsc",

24 "prepublishOnly": "npm run build",

25 "test": "vitest run",

26 "lint": "eslint src --ext .ts",

27 "sync-docs": "tsx scripts/sync-docs.ts",

28 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 },

30 "engines": {

31 "node": ">=20.0.0"

32 },

33 "repository": {

34 "type": "git",

35 "url": "git+https://github.com/bgill55/daedalus.git"

36 },

37 "homepage": "https://github.com/bgill55/daedalus#readme",

38 "bugs": {

39 "url": "https://github.com/bgill55/daedalus/issues"

40 },

41 "keywords": [

42 "cli",

43 "ai",

44 "coding",

45 "assistant",

46 "local",

47 "llm",

48 "lm-studio",

dist/tools/mcp/stdio.test.jsView file

Lines 1-22javascript

1import { describe, it, expect, vi, beforeEach } from 'vitest';

2import { EventEmitter } from 'events';

3vi.mock('child_process', () => ({

4 spawn: vi.fn(),

High

Child Process

Package source references child process execution.

dist/tools/mcp/stdio.test.jsView on unpkg · L2

5}));

dist/tools/builtin/files.jsView file

Lines 167-211javascript

167 }

168 if (ext === '.ts' || ext === '.tsx') {

169 // Walk up from the file's directory to find the nearest tsconfig.json

170 let tsconfigDir = path.dirname(filePath);

171 let tsconfigPath = null;

dist/tools/executor.jsView file

Lines 1-29javascript

1// Tool executor - loads and executes tool implementations

2import { TOOL_IMPLEMENTATIONS } from './definitions.js';

3import { executeMCPTool } from './mcp/tool-executor.js';

4const implementationCache = new Map();

5async function loadImplementation(modulePath) {

dist/tools/builtin/screenshot.jsView file

Lines 1-30javascript

1import path from 'path';

2import fs from 'fs';

3function formatError(error) {

4 return { toolCallId: '', name: 'screenshot_page', success: false, content: '', error };

Daedalus.batView file

•path = Daedalus.bat kind = build_helper sizeBytes = 439 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

Daedalus.batView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/tools/mcp/stdio.test.jsView file

2import { EventEmitter } from 'events'; L3: vi.mock('child_process', () => ({ L4: spawn: vi.fn(),

High

Child Process

Package source references child process execution.

dist/tools/mcp/stdio.test.jsView on unpkg · L2

dist/tools/builtin/files.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = daedalus-cli@1.35.9 matchedIdentity = npm:ZGFlZGFsdXMtY2xp:1.35.9 similarity = 0.941 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/tools/builtin/files.jsView on unpkg

191encoding: 'utf8', L192: shell: true, L193: });

High

Shell

Package source references shell execution.

dist/tools/builtin/files.jsView on unpkg · L191

187const tsconfigRoot = path.dirname(tsconfigPath); L188: const runTsc = () => spawnSync('npx', ['tsc', '--noEmit', '--skipLibCheck'], { L189: cwd: tsconfigRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/tools/builtin/files.jsView on unpkg · L187

dist/tools/executor.jsView file

9try { L10: const mod = await import(modulePath); L11: implementationCache.set(modulePath, mod);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/executor.jsView on unpkg · L9

dist/tools/builtin/screenshot.jsView file

10package = daedalus-cli; repositoryIdentity = daedalus; dependency = puppeteer-core L10: try { L11: puppeteer = (await import('puppeteer-core')).default; L12: }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/tools/builtin/screenshot.jsView on unpkg · L10

Daedalus.batView file

•path = Daedalus.bat kind = build_helper sizeBytes = 439 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

Daedalus.batView on unpkg

Findings

1 Critical5 High6 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/tools/builtin/files.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/tools/mcp/stdio.test.js

HighShelldist/tools/builtin/files.js

HighCopied Package Dependency Bridgedist/tools/builtin/screenshot.js

HighRuntime Package Installdist/tools/builtin/files.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/tools/executor.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build HelperDaedalus.bat

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

package.jsonView file

Lines 8-48json

8 },

9 "files": [

10 "dist/",

11 "Daedalus.bat",

12 "README.md",

13 "CHANGELOG.md",

14 "CONTRIBUTING.md",

15 "CODE_OF_CONDUCT.md",

16 "SECURITY.md",

17 "AGENTS.md",

18 "scripts/postinstall.js"

19 ],

20 "scripts": {

21 "start": "tsx src/index.ts",

22 "dev": "tsx watch src/index.ts",

23 "build": "tsc",

24 "prepublishOnly": "npm run build",

25 "test": "vitest run",

26 "lint": "eslint src --ext .ts",

27 "sync-docs": "tsx scripts/sync-docs.ts",

28 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 },

30 "engines": {

31 "node": ">=20.0.0"

32 },

33 "repository": {

34 "type": "git",

35 "url": "git+https://github.com/bgill55/daedalus.git"

36 },

37 "homepage": "https://github.com/bgill55/daedalus#readme",

38 "bugs": {

39 "url": "https://github.com/bgill55/daedalus/issues"

40 },

41 "keywords": [

42 "cli",

43 "ai",

44 "coding",

45 "assistant",

46 "local",

47 "llm",

48 "lm-studio",

dist/tools/mcp/stdio.test.jsView file

Lines 1-22javascript

1import { describe, it, expect, vi, beforeEach } from 'vitest';

2import { EventEmitter } from 'events';

3vi.mock('child_process', () => ({

4 spawn: vi.fn(),

High

Child Process

Package source references child process execution.

dist/tools/mcp/stdio.test.jsView on unpkg · L2

5}));

dist/tools/builtin/files.jsView file

Lines 167-211javascript

167 }

168 if (ext === '.ts' || ext === '.tsx') {

169 // Walk up from the file's directory to find the nearest tsconfig.json

170 let tsconfigDir = path.dirname(filePath);

171 let tsconfigPath = null;

dist/tools/executor.jsView file

Lines 1-29javascript

1// Tool executor - loads and executes tool implementations

2import { TOOL_IMPLEMENTATIONS } from './definitions.js';

3import { executeMCPTool } from './mcp/tool-executor.js';

4const implementationCache = new Map();

5async function loadImplementation(modulePath) {

dist/tools/builtin/screenshot.jsView file

Lines 1-30javascript

1import path from 'path';

2import fs from 'fs';

3function formatError(error) {

4 return { toolCallId: '', name: 'screenshot_page', success: false, content: '', error };

Daedalus.batView file

•path = Daedalus.bat kind = build_helper sizeBytes = 439 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

Daedalus.batView on unpkg