Loading npm security reports…

@jenga-ai/agent@3.1.1: AI-agent control-surface risk | LPM Firewall

registry / @jenga-ai/agent / 3.1.1

@jenga-ai/agent@3.1.1

An agentic development workflow for Claude Code, Copilot, and Codex — with a persistent Epic/Story/Task board, an isolated git worktree per task, and a separate tester agent that runs your test suite before anything is marked done.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically populates consumer AI-agent discovery directories and registers command hooks. Those hooks invoke shell scripts from the installed package on Copilot lifecycle events.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation or upgrade of the package in a consumer project.

Impact

A dependency installation changes how Claude and Copilot discover instructions and execute package-controlled hooks without an explicit setup command.

Mechanism

Automatic mutation of AI-agent skills, instructions, and lifecycle-hook configuration.

Policy narrative

When npm installs the package, its postinstall handler identifies the consumer root, copies package-controlled skills and agents into .claude and .agents, then writes .github/hooks/jenga.json. The generated configuration registers command hooks for Copilot session-end and prompt-submission events, pointing at shell scripts inside the installed dependency. This creates an unattended, package-controlled AI-agent execution and instruction surface in the consumer project.

AI rationale

This is an unconsented postinstall mutation of broad AI-agent control surfaces, including automatic command-hook registration. The absence of observed network exfiltration does not remove the concrete lifecycle control-hijack behavior.

Evidence

package.jsonscripts/postinstall.jslib/generate-copilot-hooks.js.claude/skills/.claude/agents/.agents/skills/.agents/agents/

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

skills/jenga/scripts/load-nl-catalog.jsView file

145try { L146: ({ readSkillAllowList } = await import(pathToFileURL(generatorPath).href)); L147: } catch (e) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

skills/jenga/scripts/load-nl-catalog.jsView on unpkg · L145

scripts/postinstall.jsView file

6* Copies the discovery-bound dirs — `skills/` and `agents/` — into BOTH L7: * `<consumer>/.claude/` (where Claude Code looks) and `<consumer>/.agents/` L8: * (where non-Claude agents like Copilot / custom look, per the framework's ... L40: * Location : one manifest per destination root, inside that root — L41: * <consumer>/.agents/.jenga-postinstall-manifest.json L42: * <consumer>/.claude/.jenga-postinstall-manifest.json L43: * Keeping it inside the root it describes means it travels with that ... L50: * "generated_at": "<ISO 8601>", L51: * "dest_root": ".agents", L52: * "paths": ["agents/developer.md", "skills/do/SKILL.md"] ... L203: L204: // Discovery-bound dirs get mirror

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L6

lib/commands/init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const __dirname = dirname(fileurltopath(import.meta.url)); const package_root = join(__dirname, "..", ".."); async function prompt(rl, question, defaultvalue) { return new promise(resolve => { const hint = defaultvalue !== undefined ? ` (default: ${defaultvalue})` : ""; rl.question(`${question}${hint}: `, answer => { resolve(answer.trim() || string(defaultvalue ?? "")); }); }); } export async function runinit(args, projectroot = process.cwd()) { const configpath = join(projectroot, config_file); let existing = {}; if (existssync(configpath)) { try { existing = json.parse(readfilesyn

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/commands/init.jsView on unpkg

hooks/on_session_end.shView file

•path = hooks/on_session_end.sh kind = build_helper sizeBytes = 20756 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/on_session_end.shView on unpkg

scripts/generate-legacy-shipped-paths.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/generate-legacy-shipped-paths.js#virtual:normalized:round1View on unpkg

mcp/training_runner/index.jsView file

•matchType = normalized_sha256 matchedPackage = @jenga-ai/agent@2.0.0 matchedPath = mcp/training_runner/index.js matchedIdentity = npm:QGplbmdhLWFpL2FnZW50:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp/training_runner/index.jsView on unpkg

skills/j-publish/scripts/npm_stage_pipeline.shView file

•matchType = previous_version_dangerous_delta matchedPackage = @jenga-ai/agent@3.2.0 matchedIdentity = npm:QGplbmdhLWFpL2FnZW50:3.2.0 similarity = 0.924 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

skills/j-publish/scripts/npm_stage_pipeline.shView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 1-36json

1{

2 "name": "@jenga-ai/agent",

3 "version": "3.1.1",

4 "description": "An agentic development workflow for Claude Code, Copilot, and Codex — with a persistent Epic/Story/Task board, an isolated git worktree per task, and a separate tester agent that runs your test suite before anything is marked done.",

5 "type": "module",

6 "publishConfig": {

7 "access": "public"

8 },

9 "bin": {

10 "jenga": "bin/jenga.js"

11 },

12 "engines": {

13 "node": ">=14.13.1"

14 },

15 "scripts": {

16 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 "generate:legacy-paths": "node scripts/generate-legacy-shipped-paths.js",

18 "test": "bats tests/*.bats",

19 "validate:npm-metadata": "bash scripts/validate_npm_metadata.sh",

20 "ui:dev": "npm run ui:dev --prefix project/app --",

21 "ui:build": "npm run ui:build --prefix project/app --",

22 "api:start": "npm run api:start --prefix project/app --",

23 "api:dev": "npm run api:dev --prefix project/app --",

24 "dashboard:start": "npm run dashboard:start --prefix project/app --",

25 "dashboard:open": "npm run dashboard:open --prefix project/app --"

26 },

27 "files": [

28 "skills/",

29 "agents/",

30 "hooks/",

31 "scripts/",

32 "templates/",

33 "bin/",

34 "lib/",

35 "mcp/execute-ticket/*.js",

36 "mcp/execute-ticket/package.json",

skills/jenga/scripts/load-nl-catalog.jsView file

Lines 125-165javascript

125 }

126 j++;

127 }

128

129 obj[key] = sawArray ? arrayItems : sawMap ? mapObj : [];

130 i = j;

scripts/postinstall.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * postinstall.js — Jenga AI consumer installation hook

4 *

5 * Runs automatically when a consumer project installs jenga-agent via npm.

6 * Copies the discovery-bound dirs — `skills/` and `agents/` — into BOTH

7 * `<consumer>/.claude/` (where Claude Code looks) and `<consumer>/.agents/`

8 * (where non-Claude agents like Copilot / custom look, per the framework's

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L6

lib/commands/init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const __dirname = dirname(fileurltopath(import.meta.url)); const package_root = join(__dirname, "..", ".."); async function prompt(rl, question, defaultvalue) { return new promise(resolve => { const hint = defaultvalue !== undefined ? ` (default: ${defaultvalue})` : ""; rl.question(`${question}${hint}: `, answer => { resolve(answer.trim() || string(defaultvalue ?? "")); }); }); } export async function runinit(args, projectroot = process.cwd()) { const configpath = join(projectroot, config_file); let existing = {}; if (existssync(configpath)) { try { existing = json.parse(readfilesyn

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/commands/init.jsView on unpkg

hooks/on_session_end.shView file

•path = hooks/on_session_end.sh kind = build_helper sizeBytes = 20756 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/on_session_end.shView on unpkg

scripts/generate-legacy-shipped-paths.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/generate-legacy-shipped-paths.js#virtual:normalized:round1View on unpkg

mcp/training_runner/index.jsView file

•matchType = normalized_sha256 matchedPackage = @jenga-ai/agent@2.0.0 matchedPath = mcp/training_runner/index.js matchedIdentity = npm:QGplbmdhLWFpL2FnZW50:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp/training_runner/index.jsView on unpkg

skills/j-publish/scripts/npm_stage_pipeline.shView file

•matchType = previous_version_dangerous_delta matchedPackage = @jenga-ai/agent@3.2.0 matchedIdentity = npm:QGplbmdhLWFpL2FnZW50:3.2.0 similarity = 0.924 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

skills/j-publish/scripts/npm_stage_pipeline.shView on unpkg