Loading npm security reports…

@jenga-ai/agent@1.2.4: AI-agent control-surface risk | LPM Firewall

registry / @jenga-ai/agent / 1.2.4

@jenga-ai/agent@1.2.4

Structured multi-agent development workflow for AI coding agents — scrum board, role-bounded scrum master / developer / tester agents, and 30+ slash-command skills. Works with Claude Code, GitHub Copilot, and Codex.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically mutates several AI-agent control surfaces in the consumer project. It copies behavior-bearing content into .claude and .agents and writes Copilot instructions without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation runs the postinstall hook.

Impact

Consumer AI-agent discovery paths and Copilot routing instructions can be replaced or augmented with package-controlled content.

Mechanism

Unattended recursive mirroring and instruction-file generation.

Policy narrative

The manifest invokes postinstall automatically. That hook uses the installing project as its destination, recursively copies package-controlled skills and agents into both Claude and general agent discovery directories, and can overwrite differing files. It then creates or modifies Copilot instructions without an interactive command. This is an unconsented, install-time mutation of broad foreign AI-agent control surfaces.

AI rationale

The automatic lifecycle hook changes consumer AI-agent configuration and discovery content without explicit user setup. This meets the install-time AI-agent control-surface mutation block policy despite no observed network exfiltration.

Evidence

package.jsonscripts/postinstall.jslib/mirror.jslib/generate-copilot-instructions.js.claude/skills/.claude/agents/.agents/skills/.agents/agents/.github/copilot-instructions.md

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

15"scripts": { "postinstall": "node scripts/postinstall.js", "test": "bats tests/*.bats",

High

Suspicious Lifecycle Evidence

The manifest automatically runs a postinstall script.

package.jsonView on unpkg · L15

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

6* Copies the discovery-bound dirs — `skills/` and `agents/` — into BOTH L7: * `<consumer>/.claude/` (where Claude Code looks) and `<consumer>/.agents/` L8: * (where non-Claude agents like Copilot / custom look, per the framework's ... L112: L113: // Discovery-bound dirs get mirrored to both .claude/ (Claude Code) and L114: // .agents/ (Copilot / custom). Everything else is sourced from L115: // node_modules/jenga-agent/… at runtime — no duplication. L116: const copySet = ['skills', 'agents']; L117: const targetRoots = ['.claude', '.agents']; L118: ... L160: // the separate `jenga init` CLI wizard) gets no `/skill-name` routing instructions at all L161: // (E46_S03_T01). `.agents/skills` is passed as the skills directory because that's the

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L6

lib/commands/init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const __dirname = dirname(fileurltopath(import.meta.url)); const package_root = join(__dirname, "..", ".."); async function prompt(rl, question, defaultvalue) { return new promise(resolve => { const hint = defaultvalue !== undefined ? ` (default: ${defaultvalue})` : ""; rl.question(`${question}${hint}: `, answer => { resolve(answer.trim() || string(defaultvalue ?? "")); }); }); } export async function runinit(args, projectroot = process.cwd()) { const configpath = join(projectroot, config_file); let existing = {}; if (existssync(configpath)) { try { existing = json.parse(readfilesyn

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/commands/init.jsView on unpkg

hooks/on_session_end.shView file

•path = hooks/on_session_end.sh kind = build_helper sizeBytes = 18439 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/on_session_end.shView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 1-36json

1{

2 "name": "@jenga-ai/agent",

3 "version": "1.2.4",

4 "description": "Structured multi-agent development workflow for AI coding agents — scrum board, role-bounded scrum master / developer / tester agents, and 30+ slash-command skills. Works with Claude Code, GitHub Copilot, and Codex.",

5 "type": "module",

6 "publishConfig": {

7 "access": "public"

8 },

9 "bin": {

10 "jenga": "./bin/jenga.js"

11 },

12 "engines": {

13 "node": ">=14.13.1"

14 },

15 "scripts": {

16 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 "test": "bats tests/*.bats",

High

Suspicious Lifecycle Evidence

The manifest automatically runs a postinstall script.

package.jsonView on unpkg · L15

18 "validate:npm-metadata": "bash scripts/validate_npm_metadata.sh",

19 "ui:dev": "npm run ui:dev --prefix project/app",

20 "ui:build": "npm run ui:build --prefix project/app",

21 "api:start": "npm run api:start --prefix project/app",

22 "api:dev": "npm run api:dev --prefix project/app",

23 "dashboard:start": "npm run dashboard:start --prefix project/app",

24 "dashboard:open": "npm run dashboard:open --prefix project/app"

25 },

26 "files": [

27 "skills/",

28 "agents/",

29 "hooks/",

30 "scripts/",

31 "templates/",

32 "bin/",

33 "lib/",

34 "mcp/",

35 "README.md",

36 "LICENSE"

scripts/postinstall.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * postinstall.js — Jenga AI consumer installation hook

4 *

5 * Runs automatically when a consumer project installs jenga-agent via npm.

6 * Copies the discovery-bound dirs — `skills/` and `agents/` — into BOTH

7 * `<consumer>/.claude/` (where Claude Code looks) and `<consumer>/.agents/`

8 * (where non-Claude agents like Copilot / custom look, per the framework's

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L6

lib/commands/init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const __dirname = dirname(fileurltopath(import.meta.url)); const package_root = join(__dirname, "..", ".."); async function prompt(rl, question, defaultvalue) { return new promise(resolve => { const hint = defaultvalue !== undefined ? ` (default: ${defaultvalue})` : ""; rl.question(`${question}${hint}: `, answer => { resolve(answer.trim() || string(defaultvalue ?? "")); }); }); } export async function runinit(args, projectroot = process.cwd()) { const configpath = join(projectroot, config_file); let existing = {}; if (existssync(configpath)) { try { existing = json.parse(readfilesyn

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/commands/init.jsView on unpkg

hooks/on_session_end.shView file

•path = hooks/on_session_end.sh kind = build_helper sizeBytes = 18439 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/on_session_end.shView on unpkg