Loading npm security reports…

@jenga-ai/agent@2.0.0: AI-agent control-surface risk | LPM Firewall

registry / @jenga-ai/agent / 2.0.0

@jenga-ai/agent@2.0.0

Structured multi-agent development workflow for AI coding agents — scrum board, role-bounded scrum master / developer / tester agents, and 30+ slash-command skills. Works with Claude Code, GitHub Copilot, and Codex.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies AI-agent discovery and instruction files in the consuming project. It injects packaged skills and agents without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation runs the postinstall lifecycle hook.

Impact

Package-authored agent behavior becomes available to Claude, Copilot, and compatible agents in the consumer project.

Mechanism

automatic copying into AI-agent control and instruction paths

Policy narrative

On npm installation, the postinstall hook selects the consumer directory from INIT_CWD, mirrors package skills and agents into both .claude and .agents, and can overwrite files whose contents differ. It then creates or updates .github/copilot-instructions.md without an interactive setup action. These are behavior-bearing AI-agent discovery and control paths in the consumer project, so the package changes the consumer's agent environment as an automatic lifecycle side effect.

AI rationale

The package has a concrete, automatic postinstall path that writes package-provided content into broad AI-agent discovery directories and Copilot instructions in the consumer project. This meets the install-time AI-agent control-surface mutation blocking policy despite no observed network or credential theft.

Evidence

package.jsonscripts/postinstall.jslib/mirror.jslib/generate-copilot-instructions.js.claude/skills.claude/agents.agents/skills.agents/agents.github/copilot-instructions.md

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

15"scripts": { "postinstall": "node scripts/postinstall.js", "test": "bats tests/*.bats",

High

Suspicious Lifecycle Evidence

An automatic postinstall hook runs on package installation.

package.jsonView on unpkg · L15

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

6* Copies the discovery-bound dirs — `skills/` and `agents/` — into BOTH L7: * `<consumer>/.claude/` (where Claude Code looks) and `<consumer>/.agents/` L8: * (where non-Claude agents like Copilot / custom look, per the framework's ... L113: L114: // Discovery-bound dirs get mirrored to both .claude/ (Claude Code) and L115: // .agents/ (Copilot / custom). Everything else is sourced from L116: // node_modules/jenga-agent/… at runtime — no duplication. L117: const copySet = ['skills', 'agents']; L118: const targetRoots = ['.claude', '.agents']; L119: ... L158: // Regenerate the canonical skill allow-list (E50_S02) from the freshly mirrored L159: // `.agents/skills` BEFORE bootstrapping .github/copilot-instructions.md below — so a consumer

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L6

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. oot, entry))) { console.log(` ⚠ ${entry}/ not found in package — skipped`); } } let totalcopied = 0; let totalskipped = 0; for (const targetroot of targetroots) { const destroot = path.join(consumerroot, targetroot); const result = mirror({ sourceroot: packageroot, destroot, copyset, dryrun: false, reconciledeletes: false, });

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/postinstall.jsView on unpkg

hooks/on_session_end.shView file

•path = hooks/on_session_end.sh kind = build_helper sizeBytes = 20756 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/on_session_end.shView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 1-36json

1{

2 "name": "@jenga-ai/agent",

3 "version": "2.0.0",

4 "description": "Structured multi-agent development workflow for AI coding agents \u2014 scrum board, role-bounded scrum master / developer / tester agents, and 30+ slash-command skills. Works with Claude Code, GitHub Copilot, and Codex.",

5 "type": "module",

6 "publishConfig": {

7 "access": "public"

8 },

9 "bin": {

10 "jenga": "bin/jenga.js"

11 },

12 "engines": {

13 "node": ">=14.13.1"

14 },

15 "scripts": {

16 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 "test": "bats tests/*.bats",

High

Suspicious Lifecycle Evidence

An automatic postinstall hook runs on package installation.

package.jsonView on unpkg · L15

18 "validate:npm-metadata": "bash scripts/validate_npm_metadata.sh",

19 "ui:dev": "npm run ui:dev --prefix project/app --",

20 "ui:build": "npm run ui:build --prefix project/app --",

21 "api:start": "npm run api:start --prefix project/app --",

22 "api:dev": "npm run api:dev --prefix project/app --",

23 "dashboard:start": "npm run dashboard:start --prefix project/app --",

24 "dashboard:open": "npm run dashboard:open --prefix project/app --"

25 },

26 "files": [

27 "skills/",

28 "agents/",

29 "hooks/",

30 "scripts/",

31 "templates/",

32 "bin/",

33 "lib/",

34 "mcp/execute-ticket/*.js",

35 "mcp/execute-ticket/package.json",

36 "mcp/help/*.js",

scripts/postinstall.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * postinstall.js — Jenga AI consumer installation hook

4 *

5 * Runs automatically when a consumer project installs jenga-agent via npm.

6 * Copies the discovery-bound dirs — `skills/` and `agents/` — into BOTH

7 * `<consumer>/.claude/` (where Claude Code looks) and `<consumer>/.agents/`

8 * (where non-Claude agents like Copilot / custom look, per the framework's

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L6

hooks/on_session_end.shView file

•path = hooks/on_session_end.sh kind = build_helper sizeBytes = 20756 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/on_session_end.shView on unpkg