registry / AI-agent capability abuse / @delorenj/pjangler / 1.3.7

@delorenj/pjangler@1.3.7

Project subsystem bootstrapper CLI

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No concrete malicious behavior was found, but the package provides consequential AI-agent configuration and provisioning capabilities when explicitly run. Downgrade to a warning for this dangerous, user-invoked capability rather than block publication.

Static reason

No blocking static signals were detected.

Trigger

User runs migrate/hermes-agent or invokes the MCP deployment tool with apply/opt-ins.

Impact

May change AGENTS.md, CLAUDE.md, and GEMINI.md in the selected project and handle user-provided service credentials.

Mechanism

User-invoked AI-agent project configuration and provisioning.

AI rationale

Evidence

package.jsondist/index.jsdist/mcp-server.jsAGENTS.mdCLAUDE.mdGEMINI.md

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Explicit migrate command can alter project AI-agent instruction files.
Migration promotes AGENTS.md and rewires CLAUDE.md/GEMINI.md as symlinks.
Explicit Hermes provisioning supports agent, systemd, cloud, and credential setup.
Telegram token handling is interactive and optionally stores a user-supplied token in 1Password.

Evidence against

No preinstall, install, or postinstall hook; only prepublishOnly exists.
Entrypoints are CLI/MCP binaries, not import-time execution.
MCP deployment defaults to preview and requires apply plus explicit external-effect opt-ins.
No source-confirmed credential exfiltration, stealth payload, or install-time mutation.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 980 KB of source, external domains: dash.cloudflare.com, github.com, plane.delo.sh, raw.githubusercontent.com, trello.com

Source & flagged code

5 flagged

.mise/scripts/versioning.shView file

•path = .mise/scripts/versioning.sh kind = payload_in_excluded_dir sizeBytes = 8295 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.mise/scripts/versioning.shView on unpkg

•path = .mise/scripts/versioning.sh kind = build_helper sizeBytes = 8295 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.mise/scripts/versioning.shView on unpkg

dist/index.jsView file

Lines 11671-11711javascript

11671 console.log(formatMomoReadinessReport(report2));

11672 }

11673 process.exit(report2.ready ? 0 : 1);

11674 }

11675 if (profile) {

11676 console.error(`${xmark} Unknown audit profile: ${bold(profile)}`);

11677 process.exit(1);

11678 }

11679 const report = runAudit(repo);

11680 if (options.json) {

11681 console.log(JSON.stringify(report, null, 2));

11682 } else {

11683 console.log(formatAuditReport(report));

11684 }

11685 process.exit(report.ok ? 0 : 1);

11686 } catch (err) {

11687 console.error(`${xmark} audit failed:`, err);

11688 process.exit(1);

11689 }

11690});

11691program.command("migrate").argument("[rule-id]", "Rule ID to migrate (omit to open interactive rule selector)").argument("[repo]", "Path to repo (default: cwd)").description("Idempotent migration recipe for a parity rule (or open the rule selector)").option("--all", "Apply every migration recipe in order").option("--dry-run", "Preview changes without writing files"

11692 "--accept-registry-matches",

11693 "Apply the proposed mapping of legacy committed .agents/skills entries into .agents/skills.json (reported only by default)"

11694).option("--json", "Output machine-parseable JSON").action(async (ruleId, repo, options) => {

Medium

Ai Review Evidence

Explicit migrate command can alter project AI-agent instruction files.

dist/index.jsView on unpkg · L11691

11695 try {

11696 const all = options.all ?? false;

11697 const dryRun = options.dryRun ?? false;

11698 const acceptRegistryMatches = options.acceptRegistryMatches ?? false;

11699 if (all) {

11700 let actualRepo = repo;

11701 if (ruleId && !actualRepo) {

11702 actualRepo = ruleId;

11703 }

11704 const report2 = runMigration(void 0, actualRepo, dryRun, true, acceptRegistryMatches);

11705 printMigrationReport(report2, options.json);

11706 process.exit(report2.ok ? 0 : 1);

11707 }

11708 if (ruleId && repo) {

11709 if (!getParityRuleIds().includes(ruleId)) {

11710 console.error(`${xmark} Unknown parity rule: ${bold(ruleId)}`);

11711 process.exit(1);

•path = dist/index.js kind = trigger_reachable_excluded_payload sizeBytes = 507306 triggerReachableSource = dist/index.js excludedPayload = .mise/scripts/versioning.sh

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

dist/index.jsView on unpkg

dist/mcp-server.jsView file

Lines 4023-4063javascript

4023 }

4024 const details = [];

4025 for (const file of ["CLAUDE.md", "GEMINI.md"]) {

4026 const

Source & flagged code

5 flagged · loading source

.mise/scripts/versioning.shView file

•path = .mise/scripts/versioning.sh kind = payload_in_excluded_dir sizeBytes = 8295 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.mise/scripts/versioning.shView on unpkg

•path = .mise/scripts/versioning.sh kind = build_helper sizeBytes = 8295 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.mise/scripts/versioning.shView on unpkg

dist/index.jsView file

•path = dist/index.js kind = trigger_reachable_excluded_payload sizeBytes = 507306 triggerReachableSource = dist/index.js excludedPayload = .mise/scripts/versioning.sh

Critical

Trigger Reachable Excluded Directory Payload

Findings

1 Critical1 High5 Medium5 Low

CriticalTrigger Reachable Excluded Directory Payloaddist/index.js

HighPayload In Excluded Dir.mise/scripts/versioning.sh

MediumEnvironment Vars

MediumShips Build Helper.mise/scripts/versioning.sh

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/index.js

MediumAi Review Evidencedist/mcp-server.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @delorenj/pjangler@1.3.7.

See all versions of @delorenj/pjangler for other recorded verdicts.

Review the evidence and your use of @delorenj/pjangler@1.3.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-19 17:11:46.477Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code