Loading npm security reports…
An agentic development workflow for Claude Code, Copilot, and Codex — with a persistent Epic/Story/Task board, an isolated git worktree per task, and a separate tester agent that runs your test suite before anything is marked done.
LPM flags this version as an AI-agent control-surface risk. Installing the package runs a postinstall hook that copies skills and agents into the consumer .claude and .agents directories and writes Copilot instruction and hook files. Those paths are Claude Code and Copilot control surfaces, and the writes happen without a separate setup command. Copilot hooks then run this package's shell scripts on session end and on each submitted prompt.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references child process execution.
mcp/training_runner/index.jsView on unpkg · L15Source file is highly similar to a previously finalized malicious package; route for source-aware review.
mcp/training_runner/index.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
project/app/ui/scripts/build-snapshot-html.cjsView on unpkgPackage source references dynamic require/import behavior.
project/app/ui/scripts/build-snapshot-html.cjsView on unpkg · L40A single source file combines environment access, network access, and code or shell execution; review context before blocking.
project/app/ui/scripts/dashboard-open.cjsView on unpkg · L16Source file is highly similar to a previously finalized malicious package; route for source-aware review.
project/app/ui/scripts/dashboard-open.cjsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.jsView on unpkg · L6Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
lib/commands/init.jsView on unpkgPackage ships non-JavaScript build or shell helper files.
hooks/on_session_end.shView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
project/app/api/parsers/todo.js#virtual:normalized:round1View on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
project/app/ui/scripts/dashboard-start.cjsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/commands/dashboard.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
project/app/api/scripts/capture-snapshot.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
project/app/api/parsers/architecture.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
skills/j-publish/scripts/npm_stage_pipeline.shView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
skills/j-uncharted/scripts/import-source.shView on unpkgThis report applies to @jenga-ai/agent@3.5.0.
See version security history for other recorded verdicts.
Evidence last updated: .
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
project/app/ui/scripts/dashboard-open.cjsView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L16Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L16Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.jsView on unpkg · L6Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
lib/commands/init.jsView on unpkgPackage ships non-JavaScript build or shell helper files.
hooks/on_session_end.shView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
project/app/api/parsers/todo.js#virtual:normalized:round1View on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
project/app/ui/scripts/dashboard-start.cjsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/commands/dashboard.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
project/app/api/scripts/capture-snapshot.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
project/app/api/parsers/architecture.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
skills/j-publish/scripts/npm_stage_pipeline.shView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
skills/j-uncharted/scripts/import-source.shView on unpkgPackage source references child process execution.
mcp/training_runner/index.jsView on unpkg · L15Source file is highly similar to a previously finalized malicious package; route for source-aware review.
mcp/training_runner/index.jsView on unpkgPackage source references dynamic require/import behavior.
project/app/ui/scripts/build-snapshot-html.cjsView on unpkg · L40Source file is highly similar to a previously finalized malicious package; route for source-aware review.
project/app/ui/scripts/build-snapshot-html.cjsView on unpkgA single source file combines environment access, network access, and code or shell execution; review context before blocking.
project/app/ui/scripts/dashboard-open.cjsView on unpkg · L16Source file is highly similar to a previously finalized malicious package; route for source-aware review.
project/app/ui/scripts/dashboard-open.cjsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
project/app/ui/scripts/dashboard-open.cjsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
project/app/ui/scripts/dashboard-open.cjsView on unpkg