Loading npm security reports…
An agentic development workflow for Claude Code, Copilot, and Codex — with a persistent Epic/Story/Task board, an isolated git worktree per task, and a separate tester agent that runs your test suite before anything is marked done.
LPM flags this version as an AI-agent control-surface risk. On npm install, postinstall copies this package's skills and agents into the consumer project's Claude and generic agent discovery directories and writes GitHub Copilot instruction and hook files. The hook file points session end and every submitted user prompt at shell scripts shipped inside the package.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references child process execution.
mcp/training_runner/index.jsView on unpkg · L15Source file is highly similar to a previously finalized malicious package; route for source-aware review.
mcp/training_runner/index.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
project/app/ui/scripts/build-snapshot-html.cjsView on unpkgPackage source references dynamic require/import behavior.
project/app/ui/scripts/build-snapshot-html.cjsView on unpkg · L46A single source file combines environment access, network access, and code or shell execution; review context before blocking.
project/app/ui/scripts/dashboard-open.cjsView on unpkg · L16Source file is highly similar to a previously finalized malicious package; route for source-aware review.
project/app/ui/scripts/dashboard-open.cjsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
project/app/ui/scripts/dashboard-open.cjsSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.jsView on unpkg · L6Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
lib/commands/init.jsView on unpkgPackage ships non-JavaScript build or shell helper files.
hooks/on_session_end.shView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
project/app/api/parsers/todo.js#virtual:normalized:round1View on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
project/app/ui/scripts/dashboard-start.cjsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/commands/dashboard.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
project/app/api/scripts/capture-snapshot.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
project/app/api/parsers/architecture.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
skills/j-publish/scripts/npm_stage_pipeline.shView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
skills/j-uncharted/scripts/import-source.shView on unpkgThis report applies to @jenga-ai/agent@4.0.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L20Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L20Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.jsView on unpkg · L6Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
lib/commands/init.jsView on unpkgPackage ships non-JavaScript build or shell helper files.
hooks/on_session_end.shView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
project/app/api/parsers/todo.js#virtual:normalized:round1View on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
project/app/ui/scripts/dashboard-start.cjsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/commands/dashboard.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
project/app/api/scripts/capture-snapshot.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
project/app/api/parsers/architecture.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
skills/j-publish/scripts/npm_stage_pipeline.shView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
skills/j-uncharted/scripts/import-source.shView on unpkgPackage source references child process execution.
mcp/training_runner/index.jsView on unpkg · L15Source file is highly similar to a previously finalized malicious package; route for source-aware review.
mcp/training_runner/index.jsView on unpkgPackage source references dynamic require/import behavior.
project/app/ui/scripts/build-snapshot-html.cjsView on unpkg · L46Source file is highly similar to a previously finalized malicious package; route for source-aware review.
project/app/ui/scripts/build-snapshot-html.cjsView on unpkgA single source file combines environment access, network access, and code or shell execution; review context before blocking.
project/app/ui/scripts/dashboard-open.cjsView on unpkg · L16Source file is highly similar to a previously finalized malicious package; route for source-aware review.
project/app/ui/scripts/dashboard-open.cjsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
project/app/ui/scripts/dashboard-open.cjsView on unpkg