registry / AI-agent control-surface risk / siesa-agents
siesa-agents
Paquete para instalar y configurar agentes SIESA en tu proyecto
This report shows the evidence for siesa-agents@2.1.104. 8 of 11 known versions are blocked or flagged. The newest version, 2.1.108, is flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe automatic postinstall performs unconsented, overwrite-enabled mutation of broad AI-agent control surfaces. This is concrete install-hook abuse under the stated policy.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing the package through npm activates postinstall.
Impact
Package installation can alter agent instructions, MCP configuration, editor settings, and repository state in the consumer project.
Mechanism
The installer maps shipped content into .claude, .gemini, .mcp.json, .vscode, and .github with overwrite enabled, then runs Git commands and clones an external repository.
Policy narrative
A normal npm install invokes bin/install.js automatically. That code copies package-controlled material over broad project control surfaces used by AI agents and developer tooling, then initializes or modifies Git state and clones remote content. These actions occur before the user invokes the advertised CLI, so the lifecycle hook can influence the consumer project's agent configuration without consent.
AI rationale
The automatic postinstall performs unconsented, overwrite-enabled mutation of broad AI-agent control surfaces. This is concrete install-hook abuse under the stated policy.
Evidence
package.jsonbin/install.jsbin/folder-mappings.js.claude.gemini.mcp.json.vscode.github_bmad-output/design-artifacts
Network endpoints1
github.com/SiesaTeams/architecture-platform-sa-design-artifacts
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The package automatically runs its installer after npm installation.
- The installer copies package content into the consumer project with overwrite enabled.
- The mapped destinations include Claude, Gemini, MCP, VS Code, and GitHub control directories.
- The automatic installer initializes Git and clones a remote repository into the consumer project.
Evidence against
- No runtime dependency on this package name was declared.
- The inspected remote clone target is a named GitHub repository rather than an opaque payload URL.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
20 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./bin/install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgclaude/commands/get-features/oauth-login.jsView file
13L14: const http = require('http');
L15: const https = require('https');
L16: const { exec } = require('child_process');
L17: const fs = require('fs');
...
L21: // Load shared configuration
L22: const config = JSON.parse(fs.readFileSync(path.join(__dirname, 'oauth-config.json')));
L23:
...
L42: function openBrowser(url) {
L43: const platform = process.platform;
L44: if (platform === 'win32') {
...
L77: req.on('error', reject);
High
Findings
1 Critical17 High5 Medium4 Low
CriticalAi Agent Control Hijackbin/install.js
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilityclaude/commands/get-features/oauth-login.js
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/install.js
HighPayload In Excluded Dirclaude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.py
HighSemantic Analysis Limitedsiesa-agents/observability/scripts/sa-init-env.js#virtual:normalized:round1
HighKnown Malware Source Similaritybin/install.js
HighKnown Malware Source Similarityclaude/commands/get-features/oauth-login.js
HighKnown Malware Source Similaritysiesa-agents/observability/scripts/sa-emit.js
Affected versions and remediation
This report applies to siesa-agents@2.1.104.
The versions list below shows the verdict for each recorded version.
- Avoid installing siesa-agents@2.1.104. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
11 known versions2.1.108latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 14, 2026, 10:00 PM2.1.107SuspiciousAgent extension lifecycle riskWarnPublishedOct 14, 2026, 9:03 PM2.1.106SuspiciousAgent extension lifecycle riskWarnPublishedOct 13, 2026, 3:44 PM2.1.104shownMaliciousSoft block: AI-agent control surfaceBlockPublished