registry / AI-agent control-surface risk / @jacebenson/jsn

@jacebenson/jsn

A command-line interface for ServiceNow that follows the Unix philosophy: simple, composable, and scriptable.

This report shows the evidence for @jacebenson/jsn@3.3.1. 1 of 25 known versions is blocked or flagged. The newest version, 4.3.9, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Source inspection confirms an unguarded postinstall mutation of foreign/broad agent skill locations. The lifecycle condition contradicts the script's global-install-only claim.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation of @jacebenson/jsn@3.3.1

Impact

Persists package-controlled instructions into broad user AI-agent control surfaces.

Mechanism

postinstall copies a skill and replaces a Claude Code skill path with a symlink

Policy narrative

Installing the package invokes scripts/postinstall.mjs. The script's check accepts npm_lifecycle_event === postinstall, so it executes during the postinstall hook rather than only on global installs. It creates ~/.agents/skills/servicenow, copies the bundled skill there, then removes and recreates ~/.claude/skills/servicenow as a symlink to that directory. This is unconsented install-time mutation of AI-agent control surfaces.

AI rationale

Source inspection confirms an unguarded postinstall mutation of foreign/broad agent skill locations. The lifecycle condition contradicts the script's global-install-only claim.

Evidence

package.jsonscripts/postinstall.mjsskills/servicenow/SKILL.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs scripts/postinstall.mjs as postinstall.
scripts/postinstall.mjs always installs: npm_lifecycle_event is postinstall during that hook, making its global-install check true.
Postinstall copies skills/servicenow/SKILL.md into ~/.agents/skills/servicenow/SKILL.md.
Postinstall creates ~/.claude/skills/servicenow symlink and unlinks any existing target.

Evidence against

Bundled skill is ServiceNow CLI guidance; no credential harvesting or exfiltration was found.
ServiceNow API and OAuth traffic in src/sdk.js and src/auth.js are user-configured runtime functionality.
Remote skill download is only reached by explicit jsn skill fetch/install commands.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Source & flagged code

8 flagged

package.jsonView file

Lines 1-33json

2 "name": "@jacebenson/jsn",

3 "version": "3.3.1",

4 "description": "A command-line interface for ServiceNow that follows the Unix philosophy: simple, composable, and scriptable.",

5 "type": "module",

6 "bin": {

7 "jsn": "bin/jsn.js"

8 },

9 "main": "src/cli.js",

10 "scripts": {

11 "test": "NODE_OPTIONS=--require=./suppress-warnings.cjs node --test $(find test -name '*.test.js')",

12 "lint": "npx eslint src/ bin/ test/",

13 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "start": "NODE_OPTIONS=--require=./suppress-warnings.cjs node bin/jsn.js",

15 "tag-reminder": "node scripts/tag-reminder.js",

16 "release": "node scripts/release.js"

17 },

18 "keywords": [

19 "servicenow",

20 "cli",

21 "rest-api",

22 "automation"

23 ],

24 "author": "Jace Benson",

25 "license": "MIT",

26 "engines": {

27 "node": ">=22.5.0"

28 },

29 "dependencies": {

30 "@inquirer/core": "^10.1.0",

31 "@inquirer/prompts": "^7.5.1",

32 "chalk": "^5.4.1",

33 "cli-table3": "^0.6.5",

scripts/release.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execSync } from 'child_process';

3import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

scripts/release.jsView on unpkg · L1

4import { fileURLToPath } from 'url';

src/auth.jsView file

Lines 386-426javascript

386 async login(instanceURL) {

387 instanceURL = normalizeInstanceURL(instanceURL);

388 const clientID = getOAuthClientID();

389 const pkce =

src/commands/skill.jsView file

Lines 1-36javascript

1import fs from 'node:fs';

2import path from 'node:path';

3import os from 'node:os';

4import process from 'node:process';

scripts/postinstall.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * postinstall.mjs — Copies the bundled ServiceNow SKILL.md to agent skill directories

4 * on npm global install. Mirrors what `basecamp`'s installer does for their skill.

5 *

6 * Only runs when `npm install -g @jacebenson/jsn`.

7 * On `npm install` (local dependency), it's a no-op.

8 */

10import fs from 'node:fs'

scripts/pre-commit-check.shView file

•path = scripts/pre-commit-check.sh kind = build_helper sizeBytes = 1784 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/pre-commit-check.shView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/release.jsView file

1#!/usr/bin/env node L2: import { execSync } from 'child_process'; L3: import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

scripts/release.jsView on unpkg · L1

Findings

1 Critical5 High5 Medium5 Low

CriticalAi Agent Control Hijackscripts/postinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/release.js

HighShellsrc/auth.js

HighSame File Env Network Executionsrc/commands/skill.js

HighPrevious Version Dangerous Deltasrc/commands/skill.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/pre-commit-check.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Low

Affected versions and remediation

This report applies to @jacebenson/jsn@3.3.1.

The versions list below shows the verdict for each recorded version.

Avoid installing @jacebenson/jsn@3.3.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-28 08:31:38.113Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

25 known versions

4.3.9latestUnknown—AllowUnder ReviewOct 15, 2026, 6:24 PM 4.3.8Unknown—AllowUnder ReviewOct 14, 2026, 12:08 AM 4.3.7Unknown—AllowUnder ReviewOct 9, 2026, 3:12 AM 4.3.6Unknown—AllowUnder ReviewOct 8, 2026, 1:29 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Source & flagged code

Related packages

Other AI-agent control-surface risk packages