Loading npm security reports…

@jacebenson/jsn@3.3.1: AI-agent control-surface risk | LPM Firewall

registry / @jacebenson/jsn / 3.3.1

@jacebenson/jsn@3.3.1

A command-line interface for ServiceNow that follows the Unix philosophy: simple, composable, and scriptable.

AI Security Review

scanned 18d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Install-time code mutates user-level AI-agent skill directories without an explicit command. Its intended global-only guard is ineffective because it runs within the postinstall lifecycle.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation of @jacebenson/jsn@3.3.1

Impact

Persists package-controlled instructions into broad user AI-agent control surfaces.

Mechanism

postinstall copies a skill and replaces a Claude Code skill path with a symlink

Policy narrative

Installing the package invokes scripts/postinstall.mjs. The script's check accepts npm_lifecycle_event === postinstall, so it executes during the postinstall hook rather than only on global installs. It creates ~/.agents/skills/servicenow, copies the bundled skill there, then removes and recreates ~/.claude/skills/servicenow as a symlink to that directory. This is unconsented install-time mutation of AI-agent control surfaces.

Rationale

Source inspection confirms an unguarded postinstall mutation of foreign/broad agent skill locations. The lifecycle condition contradicts the script's global-install-only claim.

Evidence

package.jsonscripts/postinstall.mjsskills/servicenow/SKILL.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with false-positive risk.

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/release.jsView file

1#!/usr/bin/env node L2: import { execSync } from 'child_process'; L3: import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

scripts/release.jsView on unpkg · L1

src/auth.jsView file

406cmd = 'cmd'; L407: // Windows: cmd.exe interprets & as a command separator, which truncates L408: // the URL after the first parameter. Passing an empty string as the first

High

Shell

Package source references shell execution.

src/auth.jsView on unpkg · L406

src/commands/skill.jsView file

16L17: const SKILL_RAW_URL = 'https://raw.githubusercontent.[redacted].md'; L18: ... L23: try { L24: const result = execSync('getent passwd ' + process.env.USER + ' 2>/dev/null', { encoding: 'utf-8', timeout: 3000 }); L25: const home = result.trim().split(':')[5];

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/commands/skill.jsView on unpkg · L16

•matchType = previous_version_dangerous_delta matchedPackage = @jacebenson/jsn@3.3.0 matchedIdentity = npm:QGphY2ViZW5zb24vanNu:3.3.0 similarity = 0.954 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/skill.jsView on unpkg

scripts/postinstall.mjsView file

14Install-time AI-agent control hijack evidence: L18: const AGENTS_SKILL = path.join(AGENTS_DIR, 'SKILL.md'); L19: const CLAUDE_SKILL_DIR = path.join(os.homedir(), '.claude', 'skills'); L20: const CLAUDE_SYMLINK = path.join(CLAUDE_SKILL_DIR, 'servicenow'); ... L42: try { L43: fs.mkdirSync(AGENTS_DIR, { recursive: true }); L44: } catch { ... L50: try { L51: fs.copyFileSync(SKILL_SOURCE, AGENTS_SKILL); L52: console.log(' ✓ jsn: ServiceNow skill installed to ' + AGENTS_SKILL); ... L61: L62: // Create symlink at ~/.claude/skills/servicenow → ../../.agents/skills/servicenow L63: // This is the same pattern basecamp's installer uses: ~/.claude/skills/basecamp → ../../.agents/skills/basecamp Payload evidence from skills/servicenow/SKILL.md: L14: Works with Claude Code, OpenCode, Cursor, and agent

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L14

scripts/pre-commit-check.shView file

•path = scripts/pre-commit-check.sh kind = build_helper sizeBytes = 1784 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/pre-commit-check.shView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-33json

1{

2 "name": "@jacebenson/jsn",

3 "version": "3.3.1",

4 "description": "A command-line interface for ServiceNow that follows the Unix philosophy: simple, composable, and scriptable.",

5 "type": "module",

6 "bin": {

7 "jsn": "bin/jsn.js"

8 },

9 "main": "src/cli.js",

10 "scripts": {

11 "test": "NODE_OPTIONS=--require=./suppress-warnings.cjs node --test $(find test -name '*.test.js')",

12 "lint": "npx eslint src/ bin/ test/",

13 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "start": "NODE_OPTIONS=--require=./suppress-warnings.cjs node bin/jsn.js",

15 "tag-reminder": "node scripts/tag-reminder.js",

16 "release": "node scripts/release.js"

17 },

18 "keywords": [

19 "servicenow",

20 "cli",

21 "rest-api",

22 "automation"

23 ],

24 "author": "Jace Benson",

25 "license": "MIT",

26 "engines": {

27 "node": ">=22.5.0"

28 },

29 "dependencies": {

30 "@inquirer/core": "^10.1.0",

31 "@inquirer/prompts": "^7.5.1",

32 "chalk": "^5.4.1",

33 "cli-table3": "^0.6.5",

scripts/release.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execSync } from 'child_process';

3import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

scripts/release.jsView on unpkg · L1

4import { fileURLToPath } from 'url';

src/auth.jsView file

Lines 386-426javascript

386 async login(instanceURL) {

387 instanceURL = normalizeInstanceURL(instanceURL);

388 const clientID = getOAuthClientID();

389 const pkce =

src/commands/skill.jsView file

Lines 1-36javascript

1import fs from 'node:fs';

2import path from 'node:path';

3import os from 'node:os';

4import process from 'node:process';

scripts/postinstall.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * postinstall.mjs — Copies the bundled ServiceNow SKILL.md to agent skill directories

4 * on npm global install. Mirrors what `basecamp`'s installer does for their skill.

5 *

6 * Only runs when `npm install -g @jacebenson/jsn`.

7 * On `npm install` (local dependency), it's a no-op.

8 */

9

10import fs from 'node:fs'

scripts/pre-commit-check.shView file

•path = scripts/pre-commit-check.sh kind = build_helper sizeBytes = 1784 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/pre-commit-check.shView on unpkg