registry / siesa-agents / 2.1.106
siesa-agents@2.1.106
Paquete para instalar y configurar agentes SIESA en tu proyecto
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe postinstall hook automatically installs or updates first-party agent configuration in the consumer's working tree. This matches the warning category for package-owned agent setup; the inspected source does not establish a separate concrete attack chain.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Installing the package runs its postinstall hook.
Impact
Agent configuration is installed or updated during package installation without a separate CLI invocation.
Mechanism
The installer copies package mappings into the current working directory, including .claude, .github, .vscode, and _siesa-agents.
AI rationale
The postinstall hook automatically installs or updates first-party agent configuration in the consumer's working tree. This matches the warning category for package-owned agent setup; the inspected source does not establish a separate concrete attack chain.
Evidence
package.jsonbin/install.jsbin/folder-mappings.js.claude.github.vscode_siesa-agents
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs the installer from postinstall, and the installer entrypoint calls its install routine.
- The installer targets the current working directory and copies packaged mappings there; mappings include project agent configuration paths such as .claude and .github.
- The installer documents a merge for .mcp.json that preserves user-added MCP entries.
- The observability helper targets the home Claude configuration directory and writes placeholder telemetry values.
- The Jira helper reads project-local OAuth tokens and posts refresh requests to Atlassian's token endpoint.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
18 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./bin/install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgclaude/commands/get-features/oauth-login.jsView file
13L14: const http = require('http');
L15: const https = require('https');
L16: const { exec } = require('child_process');
L17: const fs = require('fs');
...
L21: // Load shared configuration
L22: const config = JSON.parse(fs.readFileSync(path.join(__dirname, 'oauth-config.json')));
L23:
...
L42: function openBrowser(url) {
L43: const platform = process.platform;
L44: if (platform === 'win32') {
...
L77: req.on('error', reject);
High
Findings
1 Critical15 High5 Medium4 Low
CriticalAi Agent Control Hijackbin/install.js
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilityclaude/commands/get-features/oauth-login.js
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/install.js
HighPayload In Excluded Dirclaude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.py
HighSemantic Analysis Limitedsiesa-agents/observability/scripts/sa-init-env.js#virtual:normalized:round1
HighKnown Malware Source Similaritybin/install.js
HighKnown Malware Source Similarityclaude/commands/get-features/oauth-login.js
HighKnown Malware Source Similaritysiesa-agents/observability/scripts/sa-init-project.js
Affected versions and remediation
This report applies to siesa-agents@2.1.106.
See all versions of siesa-agents for other recorded verdicts.
- Review the evidence and your use of siesa-agents@2.1.106 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.