Loading npm security reports…

siesa-agents: AI-agent policy block | LPM Firewall

registry / siesa-agents / 2.1.88

siesa-agents@2.1.88

Paquete para instalar y configurar agentes SIESA en tu proyecto

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. The package performs unconsented install-time mutation of AI-agent and MCP control surfaces in the consuming project. It drops Claude/Gemini/GitHub agent instructions plus MCP configuration during npm postinstall, which can alter downstream AI-agent behavior before explicit CLI use.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install of siesa-agents@2.1.88 via postinstall

Impact

AI-agent control-surface mutation and automatic project file changes at install time; later user-invoked Jira OAuth tooling can create local tokens.json.

Mechanism

postinstall copies agent/MCP config into project dot-directories and initializes git

Policy narrative

Installing the package runs bin/install.js automatically. That installer maps tarball directories into dot/control paths in the current project, including .claude, .gemini, .github, .vscode and .mcp.json, then initializes git and updates .gitignore. The dropped MCP file points agents at remote MCP services and an npx-launched shadcn MCP. Although the package appears intended as an agent installer and no hidden exfiltration was found, the lifecycle hook mutates AI-agent control files without a separate user-invoked command.

Rationale

Source inspection confirms concrete install-time AI-agent/MCP control-surface writes via package.json postinstall and bin/install.js mappings. There is no confirmed credential exfiltration or obfuscated malware, but the unconsented lifecycle mutation meets the firewall policy for blocking AI-agent control hijack. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.

Evidence

package.jsonbin/install.jsbin/folder-mappings.jsmcp.json

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

claude/commands/get-features/oauth-login.jsView file

13L14: const http = require('http'); L15: const https = require('https'); L16: const { exec } = require('child_process'); L17: const fs = require('fs'); ... L21: // Load shared configuration L22: const config = JSON.parse(fs.readFileSync(path.join(__dirname, 'oauth-config.json'))); L23: ... L42: function openBrowser(url) { L43: const platform = process.platform; L44: if (platform === 'win32') { ... L77: req.on('error', reject);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

claude/commands/get-features/oauth-login.jsView on unpkg · L13

bin/install.jsView file

4Install-time AI-agent control hijack evidence: L60: // reemplazan completos (no se hace merge elemento-a-elemento). Pensado para L61: // `.mcp.json`: los MCPs que el usuario agregó (no existen en el paquete) sobreviven L62: // al update mientras los nativos se actualizan a la versión del paquete. ... L231: 'node_modules/', L232: '.claude/commands/get-features/oauth-config.json', L233: '.claude/commands/get-features/tokens.json', L234: '.vscode/settings.json', L235: '.claude.json' L236: ]; ... L253: L254: await fs.writeFile(gitignorePath, content, 'utf8'); L255: console.log('✓ .gitignore instalado correctamente.'); Payload evidence from mcp.json: L4: "type": "http", L5: "url": "https://platform-architecture-mcp-siesa-103767536676.us-east1.run.app/mcp", L6: "headers": {

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

bin/install.jsView on unpkg · L4

siesa-agents/sa/sa-skills-creator/skill-creator/eval-viewer/generate_review.pyView file

•path = siesa-agents/sa/sa-sk[redacted]/skill-creator/eval-viewer/generate_review.py kind = build_helper sizeBytes = 16365 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

siesa-agents/sa/sa-skills-creator/skill-creator/eval-viewer/generate_review.pyView on unpkg

claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.pyView file

•path = claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.py kind = payload_in_excluded_dir sizeBytes = 9245 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.pyView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 1-30json

1{

2 "name": "siesa-agents",

3 "version": "2.1.88",

4 "description": "Paquete para instalar y configurar agentes SIESA en tu proyecto",

5 "main": "index.js",

6 "bin": {

7 "siesa-agents": "./bin/install.js"

8 },

9 "scripts": {

10 "postinstall": "node ./bin/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 "build": "echo 'Build complete'"

12 },

13 "keywords": [

14 "siesa",

15 "bmad",

16 "agents",

17 "automation",

18 "cli"

19 ],

20 "author": "Sistemas de Información Empresarial",

21 "license": "MIT",

22 "files": [

23 "bmad/**/*",

24 "siesa-agents/**/*",

25 "vscode/**/*",

26 "github/**/*",

27 "!github/workflows/**",

28 "!.github/workflows/**",

29 "!github/CODEOWNERS",

30 "!.github/CODEOWNERS",

claude/commands/get-features/oauth-login.jsView file

Lines 1-33javascript

1/**

2 * oauth-login.js

3 * OAuth 2.0 (3-legged) authentication against Atlassian / Jira

4 *

5 * Usage:

6 * node oauth-login.js

7 *

8 * - Opens the browser with the Atlassian login screen

9 * - The user enters their Jira credentials

10 * - The token is saved to tokens.json (personal per user)

11

bin/install.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2

3const fs = require('fs-extra');

4const path = require('path');

5const { execSync

siesa-agents/sa/sa-skills-creator/skill-creator/eval-viewer/generate_review.pyView file

•path = siesa-agents/sa/sa-sk[redacted]/skill-creator/eval-viewer/generate_review.py kind = build_helper sizeBytes = 16365 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

siesa-agents/sa/sa-skills-creator/skill-creator/eval-viewer/generate_review.pyView on unpkg

claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.pyView file

•path = claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.py kind = payload_in_excluded_dir sizeBytes = 9245 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.pyView on unpkg