Loading npm security reports…

@jenga-ai/agent@3.4.0: Malicious npm security report (Block) | LPM Firewall

registry / @jenga-ai/agent / 3.4.0

@jenga-ai/agent@3.4.0

An agentic development workflow for Claude Code, Copilot, and Codex — with a persistent Epic/Story/Task board, an isolated git worktree per task, and a separate tester agent that runs your test suite before anything is marked done.

AI Security Review

scanned 23d ago · by lpm-firewall-ai

Installation mutates consumer AI-agent discovery directories and GitHub Copilot hook configuration without an explicit setup command. The resulting hooks invoke shell scripts from the installed package on agent lifecycle events.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Automatic npm postinstall during package installation.

Impact

Package-controlled scripts can run when Copilot submits a prompt or ends a session.

Mechanism

Install-time agent configuration and command-hook injection.

Attack narrative

Installing the package automatically runs its postinstall script. That script copies its skills and agents into consumer .claude and .agents discovery paths, then writes .github/hooks/jenga.json. The generated configuration registers package shell scripts as Copilot session-end and prompt-submission commands, creating a persistent AI-agent control path without an explicit user setup action.

AI rationale

The automatic lifecycle hook broadly mutates foreign AI-agent control surfaces and registers package-owned command callbacks. This meets the install-hook abuse blocking policy despite no observed network exfiltration.

Evidence

package.jsonscripts/postinstall.jslib/generate-copilot-hooks.js.claude/skills/.claude/agents/.agents/skills/.agents/agents/.github/copilot-instructions.md.github/hooks/jenga.json.jenga-version

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

mcp/training_runner/index.jsView file

15import { join, resolve } from "path"; L16: import { spawn } from "child_process"; L17: import { load as yamlLoad } from "js-yaml";

High

Child Process

Package source references child process execution.

mcp/training_runner/index.jsView on unpkg · L15

•matchType = normalized_sha256 matchedPackage = @jenga-ai/agent@3.1.1 matchedPath = mcp/training_runner/index.js matchedIdentity = npm:QGplbmdhLWFpL2FnZW50:3.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp/training_runner/index.jsView on unpkg

project/app/ui/scripts/build-snapshot-html.cjsView file

40L41: const fs = require('fs'); L42: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

project/app/ui/scripts/build-snapshot-html.cjsView on unpkg · L40

project/app/ui/scripts/dashboard-open.cjsView file

16L17: const http = require('http'); L18: const { execFile } = require('child_process'); L19: ... L22: L23: let port = parseInt(process.env.JENGA_API_PORT || '3001', 10); L24:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

project/app/ui/scripts/dashboard-open.cjsView on unpkg · L16

•matchType = previous_version_dangerous_delta matchedPackage = @jenga-ai/agent@3.2.0 matchedIdentity = npm:QGplbmdhLWFpL2FnZW50:3.2.0 similarity = 0.650 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

project/app/ui/scripts/dashboard-open.cjsView on unpkg

scripts/postinstall.jsView file

6* Copies the discovery-bound dirs — `skills/` and `agents/` — into BOTH L7: * `<consumer>/.claude/` (where Claude Code looks) and `<consumer>/.agents/` L8: * (where non-Claude agents like Copilot / custom look, per the framework's ... L40: * Location : one manifest per destination root, inside that root — L41: * <consumer>/.agents/.jenga-postinstall-manifest.json L42: * <consumer>/.claude/.jenga-postinstall-manifest.json L43: * Keeping it inside the root it describes means it travels with that ... L50: * "generated_at": "<ISO 8601>", L51: * "dest_root": ".agents", L52: * "paths": ["agents/developer.md", "skills/do/SKILL.md"] ... L203: L204: // Discovery-bound dirs get mirror

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L6

lib/commands/init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const __dirname = dirname(fileurltopath(import.meta.url)); const package_root = join(__dirname, "..", ".."); async function prompt(rl, question, defaultvalue) { return new promise(resolve => { const hint = defaultvalue !== undefined ? ` (default: ${defaultvalue})` : ""; rl.question(`${question}${hint}: `, answer => { resolve(answer.trim() || string(defaultvalue ?? "")); }); }); } export async function runinit(args, projectroot = process.cwd()) { const configpath = join(projectroot, config_file); let existing = {}; if (existssync(configpath)) { try { existing = json.parse(readfilesyn

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/commands/init.jsView on unpkg

hooks/on_session_end.shView file

•path = hooks/on_session_end.sh kind = build_helper sizeBytes = 20756 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/on_session_end.shView on unpkg

project/app/api/parsers/todo.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

project/app/api/parsers/todo.js#virtual:normalized:round1View on unpkg

skills/j-uncharted/scripts/import-source.shView file

•matchType = normalized_sha256 matchedPackage = @jenga-ai/agent@3.1.1 matchedPath = skills/j-uncharted/scripts/import-source.sh matchedIdentity = npm:QGplbmdhLWFpL2FnZW50:3.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/j-uncharted/scripts/import-source.shView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 1-36json

1{

2 "name": "@jenga-ai/agent",

3 "version": "3.4.0",

4 "description": "An agentic development workflow for Claude Code, Copilot, and Codex — with a persistent Epic/Story/Task board, an isolated git worktree per task, and a separate tester agent that runs your test suite before anything is marked done.",

5 "type": "module",

6 "publishConfig": {

7 "access": "public"

8 },

9 "bin": {

10 "jenga": "bin/jenga.js"

11 },

12 "engines": {

13 "node": ">=14.13.1"

14 },

15 "scripts": {

16 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 "prepack": "npm run ui:build --prefix project/app --",

18 "generate:legacy-paths": "node scripts/generate-legacy-shipped-paths.js",

19 "graph:populate": "node scripts/populate-knowledge-graph.js",

20 "test": "bats tests/*.bats",

21 "validate:npm-metadata": "bash scripts/validate_npm_metadata.sh",

22 "ui:dev": "npm run ui:dev --prefix project/app --",

23 "ui:build": "npm run ui:build --prefix project/app --",

24 "api:start": "npm run api:start --prefix project/app --",

25 "api:dev": "npm run api:dev --prefix project/app --",

26 "dashboard:start": "npm run dashboard:start --prefix project/app --",

27 "dashboard:open": "npm run dashboard:open --prefix project/app --"

28 },

29 "files": [

30 "skills/",

31 "agents/",

32 "hooks/",

33 "scripts/",

34 "templates/",

35 "bin/",

36 "lib/",

mcp/training_runner/index.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

2/**

3 * training_runner — MCP server

4 *

5 * Exposes a single tool: run_training_job

6 * - Validates the job directory and config.yaml

7 * - Checks confirm_before_run flag

8 * - Executes bash start.sh, collecting stdout/stderr

9 * - Returns a structured result including exit_code, duration, and results.json contents

10 */

11

project/app/ui/scripts/build-snapshot-html.cjsView file

Lines 20-60javascript

20 * now runs in both places. That is the point: the consumer path is no longer a

21 * separate, never-exercised branch — every local `--snapshot` run exercises it.

22 *

23 * What it does, given <dist>/

project/app/ui/scripts/dashboard-open.cjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * jenga dashboard open

4 *

5 * Usage:

6 * node scripts/dashboard-open.js [--port <number>]

7 *

8 * Performs a health check against the API server, then opens the dashboard

9 * URL in the system's default browser. Always exits with code 0.

10 *

11 * --port <number> Port to check / open (default: 3001).

scripts/postinstall.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * postinstall.js — Jenga AI consumer installation hook

4 *

5 * Runs automatically when a consumer project installs jenga-agent via npm.

6 * Copies the discovery-bound dirs — `skills/` and `agents/` — into BOTH

7 * `<consumer>/.claude/` (where Claude Code looks) and `<consumer>/.agents/`

8 * (where non-Claude agents like Copilot / custom look, per the framework's

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L6

lib/commands/init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const __dirname = dirname(fileurltopath(import.meta.url)); const package_root = join(__dirname, "..", ".."); async function prompt(rl, question, defaultvalue) { return new promise(resolve => { const hint = defaultvalue !== undefined ? ` (default: ${defaultvalue})` : ""; rl.question(`${question}${hint}: `, answer => { resolve(answer.trim() || string(defaultvalue ?? "")); }); }); } export async function runinit(args, projectroot = process.cwd()) { const configpath = join(projectroot, config_file); let existing = {}; if (existssync(configpath)) { try { existing = json.parse(readfilesyn

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/commands/init.jsView on unpkg

hooks/on_session_end.shView file

•path = hooks/on_session_end.sh kind = build_helper sizeBytes = 20756 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/on_session_end.shView on unpkg

project/app/api/parsers/todo.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

project/app/api/parsers/todo.js#virtual:normalized:round1View on unpkg

skills/j-uncharted/scripts/import-source.shView file

•matchType = normalized_sha256 matchedPackage = @jenga-ai/agent@3.1.1 matchedPath = skills/j-uncharted/scripts/import-source.sh matchedIdentity = npm:QGplbmdhLWFpL2FnZW50:3.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/j-uncharted/scripts/import-source.shView on unpkg