registry / AI-agent capability abuse / @jacebenson/jsn / 4.2.1

@jacebenson/jsn@4.2.1

A command-line interface for ServiceNow that follows the Unix philosophy: simple, composable, and scriptable.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package has a real explicit-user agent-extension capability that retrieves mutable remote content, so it merits a warning. Source inspection found no lifecycle hook, credential exfiltration, covert persistence, or concrete malicious chain.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

User runs `jsn skill install`.

Impact

Downloaded instructions can influence supported AI agents.

Mechanism

Remote agent-skill download and user-level agent-directory write.

AI rationale

Evidence

package.jsonsrc/cli.jssrc/commands/skill.jsskills/servicenow/SKILL.mdsrc/commands/version.jssrc/auth.jssrc/sdk.jsscripts/release.js~/.copilot/skills/servicenow/SKILL.md~/.claude/skills/servicenow/SKILL.md~/.cursor/rules/servicenow.mdc~/.agents/skills/servicenow/SKILL.md~/.config/opencode/skills/servicenow/SKILL.md~/.openclaw/skills/servicenow/SKILL.md~/.codex/skills/servicenow/SKILL.md

Network endpoints1

raw.githubusercontent.com/jacebenson/jsn/main/skills/servicenow/SKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Explicit `jsn skill install` fetches a remote skill and writes it into supported AI-agent directories.
The supported targets include Codex, Claude, Cursor, Copilot, and other user-level agent instruction locations.

Evidence against

package.json has no preinstall, install, or postinstall hook.
Agent-directory writes require the explicit `skill install` command; no automatic install-time mutation found.
Network use otherwise supports the stated ServiceNow CLI and npm version-check functions.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 73 file(s), 688 KB of source, external domains: 127.0.0.1, dev12345.service-now.com, dev328604.service-now.com, github.com, raw.githubusercontent.com, registry.npmjs.org, store.servicenow.com, www.w3.org

Source & flagged code

6 flagged

scripts/release.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execSync } from 'child_process';

3import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

scripts/release.jsView on unpkg · L1

4import { fileURLToPath } from 'url';

5import { dirname, join } from 'path';

7const __dirname = dirname(fileURLToPath(import.meta.url));

8const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8'));

10const type = process.argv[2];

11if (!type || !['patch', 'minor', 'major'].includes(type)) {

12 console.error('Usage: npm run release -- <patch|minor|major>');

13 process.exit(1);

14}

16let branch;

17try {

18 branch = execSync('git rev-parse --abbrev-ref HEAD', { encoding: 'utf8' }).trim();

19} catch {

20 console.error('Error: Not in a git repository');

21 process.exit(1);

•matchType = normalized_sha256 matchedPackage = @jacebenson/jsn@3.3.1 matchedPath = scripts/release.js matchedIdentity = npm:QGphY2ViZW5zb24vanNu:3.3.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release.jsView on unpkg

src/auth.js#virtual:normalized:round1View file

9import crypto from "node:crypto"; L10: import { execFileSync } from "node:child_process"; L11: import { password as passwordPrompt } from "@inquirer/prompts"; ... L20: * Whitelist approach (issue #143 findings #2/#3): first map the `://` L21: * protocol separator to `_` exactly as the Go version"s encoding does\n * (so existing keyring keys like `https_dev437538.service-now.com` keep\n * matching), then drop everything ... L22: const filename = key + ".json";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/auth.js#virtual:normalized:round1View on unpkg · L9

src/commands/skill.jsView file

Lines 1-26javascript

1import fs from 'node:fs';

2import path from 'node:path';

3import os from 'node:os';

4import process from 'node:process';

scripts/pre-commit-check.shView file

•path = scripts/pre-commit-check.sh kind = build_helper sizeBytes = 1784 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/pre-commit-check.shView on unpkg

src/commands/docs/public/vendor/marked.min.jsView file

•matchType = normalized_sha256 matchedPackage = @jacebenson/jsn@3.3.1 matchedPath = [redacted].min.js matchedIdentity = npm:QGphY2ViZW5zb24vanNu:3.3.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/docs/public/vendor/marked.min.jsView on unpkg

Source & flagged code

6 flagged · loading source

scripts/release.jsView file

1#!/usr/bin/env node L2: import { execSync } from 'child_process'; L3: import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

scripts/release.jsView on unpkg · L1

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release.jsView on unpkg

src/auth.js#virtual:normalized:round1View file

Findings

6 High4 Medium5 Low

HighChild Processscripts/release.js

HighShell

HighSame File Env Network Executionsrc/auth.js#virtual:normalized:round1

HighSandbox Evasion Gated Capabilitysrc/commands/skill.js

HighKnown Malware Source Similarityscripts/release.js

HighKnown Malware Source Similaritysrc/commands/docs/public/vendor/marked.min.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/pre-commit-check.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

Low

Affected versions and remediation

This report applies to @jacebenson/jsn@4.2.1.

See all versions of @jacebenson/jsn for other recorded verdicts.

Review the evidence and your use of @jacebenson/jsn@4.2.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-26 07:42:37.869Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code