registry / @markjaquith/agency / 3.9.1

@markjaquith/agency@3.9.1

Manage agentic work across repositories with durable workbases

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The postinstall hook performs automatic first-party Pi extension setup, which warrants a warning under the agent extension lifecycle policy. The inspected installer is scoped to one extension file and does not establish a concrete attack.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall; removal is triggered by preuninstall.

Impact

The installed extension becomes available to Pi; the inspected behavior does not establish credential exposure, destructive activity, or broad agent control-surface mutation.

Mechanism

A package script copies its bundled extension to the user’s Pi extensions directory and removes that file on uninstall.

AI rationale

Evidence

package.jsonscripts/install-pi-extension.tssrc/services/IntegrationService.tssrc/commands/integration.ts~/.pi/agent/extensions/agency.ts

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The postinstall hook runs the extension installer, and preuninstall runs its removal command.
The installer copies the package’s Pi extension into the user’s `.pi/agent/extensions/agency.ts` location.
The integration service inspects project agent and OpenCode configuration paths; its cited excerpt does not establish a broader mutation.

Evidence against

The installer’s destination is a single package-owned extension path, and uninstall removes that file.
The integration sync command is explicitly invoked through the CLI; no evidence here establishes an unconsented broad agent configuration write.

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 91 file(s), 902 KB of source, external domains: github.com, opencode.ai

Source & flagged code

10 flagged

package.jsonView file

Lines 55-95json

55 },

56 "./schemas/agency-execution-v1.json": {

57 "default": "./schemas/agency-execution-v1.schema.json"

58 },

59 "./fixtures/protocol/success.json": {

60 "default": "./fixtures/protocol/success.json"

61 },

62 "./fixtures/protocol/error.json": {

63 "default": "./fixtures/protocol/error.json"

64 }

65 },

66 "publishConfig": {

67 "access": "public",

68 "provenance": true,

69 "registry": "https://registry.npmjs.org/",

70 "tag": "latest"

71 },

72 "scripts": {

73 "prepack": "bun scripts/build-interactive.ts",

74 "postpack": "bun scripts/build-interactive.ts --clean",

75 "postinstall": "bun scripts/install-pi-extension.ts install",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L75

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L75

76 "preuninstall": "bun scripts/install-pi-extension.ts uninstall",

77 "benchmark:act": "bun scripts/benchmark-act.ts",

78 "benchmark:pr": "bun scripts/benchmark-pr.ts",

79 "benchmark:repositories": "bun scripts/benchmark-repositories.ts",

80 "benchmark:status": "bun scripts/benchmark-status.ts",

81 "benchmark:next": "bun scripts/benchmark-next.ts",

82 "benchmark:init": "bun scripts/benchmark-init.ts",

83 "benchmark:integration": "bun scripts/benchmark-integration.ts",

84 "benchmark:workbase": "bun scripts/benchmark-workbase.ts",

85 "benchmark:doctor": "bun scripts/benchmark-doctor.ts",

86 "benchmark:context": "bun scripts/benchmark-context.ts",

87 "benchmark:epic": "bun scripts/benchmark-epic.ts",

88 "benchmark:phase": "bun scripts/benchmark-phase.ts",

89 "benchmark:graph": "bun scripts/benchmark-graph.ts",

90 "benchmark:push": "bun scripts/benchmark-push.ts",

91 "benchmark:archive": "bun scripts/benchmark-archive.ts",

92 "benchmark:sync": "bun scripts/benchmark-sync.ts",

93 "benchmark:task": "bun scripts/benchmark-task.ts",

94 "benchmark:validate": "bun scripts/benchmark-validate.ts",

95 "benchmark:worktree": "bun scripts/benchmark-worktree.ts",

src/utils/interactive-loader.tsView file

Lines 1-7typescript

1export const loadInteractive = async () => {

2 // Resolve this at runtime so the Node-target bundle still selects Bun's preload.

3 const preload = ["@opentui", "solid",

node_modules/@opentui/core-linux-x64/libopentui.soView file

•path = node_modules/@opentui/core-linux-x64/libopentui.so kind = native_binary sizeBytes = 6312560 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

node_modules/@opentui/core-linux-x64/libopentui.soView on unpkg

node_modules/@opentui/core/assets/zig/tree-sitter-zig.wasmView file

•path = node_modules/@opentui/core/assets/zig/tree-sitter-zig.wasm kind = wasm_module sizeBytes = 691726 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

node_modules/@opentui/core/assets/zig/tree-sitter-zig.wasmView on unpkg

fixtures/protocol/error.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 34

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

fixtures/protocol/error.jsonView on unpkg

src/services/ReviewService.tsView file

•matchType = normalized_sha256 matchedPackage = @markjaquith/agency@3.3.0 matchedPath = src/services/ReviewService.ts matchedIdentity = npm:QG1hcmtqYXF1aXRoL2FnZW5jeQ:3.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/services/ReviewService.tsView on unpkg

src/services/TaskService.tsView file

•matchType = normalized_sha256 matchedPackage = @markjaquith/agency@3.3.0 matchedPath = src/services/TaskService.ts matchedIdentity = npm:QG1hcmtqYXF1aXRoL2FnZW5jeQ:3.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/services/TaskService.tsView on unpkg

src/services/VersionControlService.tsView file

•matchType = normalized_sha256 matchedPackage = @markjaquith/agency@3.3.0 matchedPath = [redacted].ts matchedIdentity = npm:QG1hcmtqYXF1aXRoL2FnZW5jeQ:3.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/services/VersionControlService.tsView on unpkg

src/utils/process.tsView file

•matchType = normalized_sha256 matchedPackage = @markjaquith/agency@3.3.0 matchedPath = src/utils/process.ts matchedIdentity = npm:QG1hcmtqYXF1aXRoL2FnZW5jeQ:3.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/process.tsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = bun scripts/install-pi-extension.ts install

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bun scripts/install-pi-extension.ts install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/utils/interactive-loader.tsView file

3const preload = ["@opentui", "solid", "preload"].join("/") L4: await import(preload) L5: return import("./interactive")

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/utils/interactive-loader.tsView on unpkg · L3

Findings

6 High7 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limitedfixtures/protocol/error.json

HighKnown Malware Source Similaritysrc/services/ReviewService.ts

HighKnown Malware Source Similaritysrc/services/TaskService.ts

HighKnown Malware Source Similaritysrc/services/VersionControlService.ts

HighKnown Malware Source Similaritysrc/utils/process.ts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiresrc/utils/interactive-loader.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarynode_modules/@opentui/core-linux-x64/libopentui.so

MediumShips Wasm Module

Affected versions and remediation

This report applies to @markjaquith/agency@3.9.1.

See all versions of @markjaquith/agency for other recorded verdicts.

Review the evidence and your use of @markjaquith/agency@3.9.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 09:55:47.333Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code