Loading npm security reports…

@jenga-ai/agent@1.2.3: AI-agent control-surface risk | LPM Firewall

registry / @jenga-ai/agent / 1.2.3

@jenga-ai/agent@1.2.3

Structured multi-agent development workflow for AI coding agents — scrum board, role-bounded scrum master / developer / tester agents, and 30+ slash-command skills. Works with Claude Code, GitHub Copilot, and Codex.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically writes package-controlled agent instructions into the consumer project's Claude and generic agent discovery paths. Existing differing instruction files can be overwritten.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation or upgrade

Impact

A package install can alter the behavior and available instructions of AI coding agents in the consumer project.

Mechanism

Postinstall mirroring into AI-agent discovery directories

Policy narrative

npm invokes the postinstall script without a separate setup command. The script selects the consumer working directory, then copies package-controlled skills and agent definitions into both .claude and .agents. Its mirror helper writes new files and overwrites differing files, allowing the package to change AI-agent control content in the consumer project at install time.

AI rationale

This is an unconsented postinstall mutation of broad foreign AI-agent discovery surfaces. The absence of observed exfiltration does not remove the concrete install-time control-hijack risk.

Evidence

package.jsonscripts/postinstall.jslib/mirror.js<consumerRoot>/.claude/skills/**<consumerRoot>/.claude/agents/**<consumerRoot>/.agents/skills/**<consumerRoot>/.agents/agents/**<consumerRoot>/.jenga-version

Decision evidence

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

15"scripts": { "postinstall": "node scripts/postinstall.js", "test": "bats tests/*.bats",

High

Suspicious Lifecycle Evidence

The package runs a postinstall hook automatically.

package.jsonView on unpkg · L15

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

6* Copies the discovery-bound dirs — `skills/` and `agents/` — into BOTH L7: * `<consumer>/.claude/` (where Claude Code looks) and `<consumer>/.agents/` L8: * (where non-Claude agents like Copilot / custom look, per the framework's ... L111: L112: // Discovery-bound dirs get mirrored to both .claude/ (Claude Code) and L113: // .agents/ (Copilot / custom). Everything else is sourced from L114: // node_modules/jenga-agent/… at runtime — no duplication. L115: const copySet = ['skills', 'agents']; L116: const targetRoots = ['.claude', '.agents']; L117: ... L156: // Write .jenga-version to record the installed version at consumer root L157: fs.writeFileSync(versionFile, packageVersion + '\n', 'utf8');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L6

lib/commands/init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const __dirname = dirname(fileurltopath(import.meta.url)); const package_root = join(__dirname, "..", ".."); async function prompt(rl, question, defaultvalue) { return new promise(resolve => { const hint = defaultvalue !== undefined ? ` (default: ${defaultvalue})` : ""; rl.question(`${question}${hint}: `, answer => { resolve(answer.trim() || string(defaultvalue ?? "")); }); }); } export async function runinit(args, projectroot = process.cwd()) { const configpath = join(projectroot, config_file); let existing = {}; if (existssync(configpath)) { try { existing = json.parse(readfilesyn

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/commands/init.jsView on unpkg

hooks/on_session_end.shView file

•path = hooks/on_session_end.sh kind = build_helper sizeBytes = 18439 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/on_session_end.shView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 1-36json

1{

2 "name": "@jenga-ai/agent",

3 "version": "1.2.3",

4 "description": "Structured multi-agent development workflow for AI coding agents — scrum board, role-bounded scrum master / developer / tester agents, and 30+ slash-command skills. Works with Claude Code, GitHub Copilot, and Codex.",

5 "type": "module",

6 "publishConfig": {

7 "access": "public"

8 },

9 "bin": {

10 "jenga": "./bin/jenga.js"

11 },

12 "engines": {

13 "node": ">=14.13.1"

14 },

15 "scripts": {

16 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 "test": "bats tests/*.bats",

High

Suspicious Lifecycle Evidence

The package runs a postinstall hook automatically.

package.jsonView on unpkg · L15

18 "validate:npm-metadata": "bash scripts/validate_npm_metadata.sh",

19 "ui:dev": "npm run ui:dev --prefix project/app",

20 "ui:build": "npm run ui:build --prefix project/app",

21 "api:start": "npm run api:start --prefix project/app",

22 "api:dev": "npm run api:dev --prefix project/app",

23 "dashboard:start": "npm run dashboard:start --prefix project/app",

24 "dashboard:open": "npm run dashboard:open --prefix project/app"

25 },

26 "files": [

27 "skills/",

28 "agents/",

29 "hooks/",

30 "scripts/",

31 "templates/",

32 "bin/",

33 "lib/",

34 "mcp/",

35 "README.md",

36 "LICENSE"

scripts/postinstall.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * postinstall.js — Jenga AI consumer installation hook

4 *

5 * Runs automatically when a consumer project installs jenga-agent via npm.

6 * Copies the discovery-bound dirs — `skills/` and `agents/` — into BOTH

7 * `<consumer>/.claude/` (where Claude Code looks) and `<consumer>/.agents/`

8 * (where non-Claude agents like Copilot / custom look, per the framework's

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L6

lib/commands/init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const __dirname = dirname(fileurltopath(import.meta.url)); const package_root = join(__dirname, "..", ".."); async function prompt(rl, question, defaultvalue) { return new promise(resolve => { const hint = defaultvalue !== undefined ? ` (default: ${defaultvalue})` : ""; rl.question(`${question}${hint}: `, answer => { resolve(answer.trim() || string(defaultvalue ?? "")); }); }); } export async function runinit(args, projectroot = process.cwd()) { const configpath = join(projectroot, config_file); let existing = {}; if (existssync(configpath)) { try { existing = json.parse(readfilesyn

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/commands/init.jsView on unpkg

hooks/on_session_end.shView file

•path = hooks/on_session_end.sh kind = build_helper sizeBytes = 18439 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/on_session_end.shView on unpkg