registry / siesa-agents / 2.1.108
siesa-agents@2.1.108
Paquete para instalar y configurar agentes SIESA en tu proyecto
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe verified postinstall performs automatic first-party agent setup, which fits the warning-only agent extension lifecycle risk. The inspected OAuth and observability code does not establish a separate attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm runs the package postinstall hook.
Impact
Agent configuration and related project files may be installed or updated automatically.
Mechanism
The hook starts bin/install.js, which copies mapped package content, including the .claude directory, into its working directory.
AI rationale
The verified postinstall performs automatic first-party agent setup, which fits the warning-only agent extension lifecycle risk. The inspected OAuth and observability code does not establish a separate attack.
Evidence
package.jsonbin/install.jsbin/folder-mappings.js
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs bin/install.js during postinstall.
- The installer copies package mappings into its working directory; its standard path runs installation or update.
- The mappings include the package-owned .claude directory.
- The installer describes .mcp.json updates as preserving custom MCP entries.
- The observability helper targets ~/.claude/observability/.env; its --check mode is read-only.
- The Jira OAuth flow targets auth.atlassian.com, and the Jira client locates its token and configuration files in the project.
Evidence against
- The inspected behavior supports a warning for automatic first-party agent setup, but does not establish credential theft or another active attack.
- The observability helper handles placeholder settings, and the inspected Jira authentication flow uses Atlassian endpoints.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
18 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./bin/install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgclaude/commands/get-features/oauth-login.jsView file
13L14: const http = require('http');
L15: const https = require('https');
L16: const { exec } = require('child_process');
L17: const fs = require('fs');
...
L21: // Load shared configuration
L22: const config = JSON.parse(fs.readFileSync(path.join(__dirname, 'oauth-config.json')));
L23:
...
L42: function openBrowser(url) {
L43: const platform = process.platform;
L44: if (platform === 'win32') {
...
L77: req.on('error', reject);
High
Findings
1 Critical15 High5 Medium4 Low
CriticalAi Agent Control Hijackbin/install.js
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilityclaude/commands/get-features/oauth-login.js
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/install.js
HighPayload In Excluded Dirclaude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.py
HighSemantic Analysis Limitedsiesa-agents/observability/scripts/sa-init-env.js#virtual:normalized:round1
HighKnown Malware Source Similaritybin/install.js
HighKnown Malware Source Similarityclaude/commands/get-features/oauth-login.js
HighKnown Malware Source Similaritysiesa-agents/observability/scripts/sa-init-project.js
Affected versions and remediation
This report applies to siesa-agents@2.1.108.
See all versions of siesa-agents for other recorded verdicts.
- Review the evidence and your use of siesa-agents@2.1.108 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.