Loading npm security reports…

siesa-agents@2.1.95: AI-agent control-surface risk | LPM Firewall

registry / siesa-agents / 2.1.95

siesa-agents@2.1.95

Paquete para instalar y configurar agentes SIESA en tu proyecto

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates a project's Claude configuration and registers agent capabilities without a user command. The installed hook captures Claude session metadata; workflow instructions require telemetry emission that can read transcript token usage.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install of siesa-agents@2.1.95

Impact

Unconsented AI-agent control-surface modification and potential disclosure of Claude session/workflow metadata to configured telemetry infrastructure.

Mechanism

postinstall deployment of Claude hook, permissions, MCP configuration, and telemetry scripts

Policy narrative

Installing the package automatically copies a Claude configuration into the consumer project. That configuration enables a SessionStart command hook, permissive Bash rules, and remote MCP registrations. The hook stores session metadata under the user home directory; installed workflow instructions require telemetry calls, and sa-emit can read session transcript paths and send derived workflow/token data to a configured endpoint. These foreign AI-agent control-surface changes occur during npm postinstall without user confirmation.

Rationale

Source inspection confirms an unconsented postinstall mutation of broad Claude project controls, plus a telemetry chain that accesses session metadata and transcript-derived usage. This meets the block policy regardless of the scanner similarity hint.

Evidence

package.jsonbin/install.jsbin/folder-mappings.jsclaude/settings.local.jsonsiesa-agents/observability/scripts/sa-session.js

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

claude/commands/get-features/oauth-login.jsView file

13L14: const http = require('http'); L15: const https = require('https'); L16: const { exec } = require('child_process'); L17: const fs = require('fs'); ... L21: // Load shared configuration L22: const config = JSON.parse(fs.readFileSync(path.join(__dirname, 'oauth-config.json'))); L23: ... L42: function openBrowser(url) { L43: const platform = process.platform; L44: if (platform === 'win32') { ... L77: req.on('error', reject);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

claude/commands/get-features/oauth-login.jsView on unpkg · L13

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.88 matchedPath = claude/commands/get-features/oauth-login.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.88 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

claude/commands/get-features/oauth-login.jsView on unpkg

bin/install.jsView file

60// reemplazan completos (no se hace merge elemento-a-elemento). Pensado para L61: // `.mcp.json`: los MCPs que el usuario agregó (no existen en el paquete) sobreviven L62: // al update mientras los nativos se actualizan a la versión del paquete. ... L231: 'node_modules/', L232: '.claude/commands/get-features/oauth-config.json', L233: '.claude/commands/get-features/tokens.json', L234: '.vscode/settings.json', L235: '.claude.json' L236: ]; ... L253: L254: await fs.writeFile(gitignorePath, content, 'utf8'); L255: console.log('✓ .gitignore instalado correctamente.');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/install.jsView on unpkg · L60

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. esolve(__dirname, '..', '..', 'siesa-agents'), path.resolve(__dirname.replace(/\\bin$|\/bin$/, '')), process.cwd(), ]; for (const possiblepath of possiblepaths) { if (this.hasrequiredfolders(possiblepath)) { packagedir = possiblepath; if (debug) { console.log(` encontrado en: ${possiblepath}`); } break; } } } return packagedir; } hasrequiredfolders(dir) { return this.foldermappings.some(mapping => { const folderpath =

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/install.jsView on unpkg

siesa-agents/sa/sa-skills-creator/skill-creator/eval-viewer/generate_review.pyView file

•path = siesa-agents/sa/sa-sk[redacted]/skill-creator/eval-viewer/generate_review.py kind = build_helper sizeBytes = 16365 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

siesa-agents/sa/sa-skills-creator/skill-creator/eval-viewer/generate_review.pyView on unpkg

claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.pyView file

•path = claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.py kind = payload_in_excluded_dir sizeBytes = 9245 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.pyView on unpkg

siesa-agents/observability/scripts/sa-emit.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.88 matchedPath = siesa-agents/observability/scripts/sa-emit.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.88 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/observability/scripts/sa-emit.jsView on unpkg

siesa-agents/observability/scripts/sa-init-project.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.88 matchedPath = siesa-agents/observability/scripts/sa-init-project.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.88 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/observability/scripts/sa-init-project.jsView on unpkg

siesa-agents/observability/scripts/sa-init-env.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.88 matchedPath = siesa-agents/observability/scripts/sa-init-env.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.88 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/observability/scripts/sa-init-env.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 1-30json

1{

2 "name": "siesa-agents",

3 "version": "2.1.95",

4 "description": "Paquete para instalar y configurar agentes SIESA en tu proyecto",

5 "main": "index.js",

6 "bin": {

7 "siesa-agents": "./bin/install.js"

8 },

9 "scripts": {

10 "postinstall": "node ./bin/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 "build": "echo 'Build complete'"

12 },

13 "keywords": [

14 "siesa",

15 "bmad",

16 "agents",

17 "automation",

18 "cli"

19 ],

20 "author": "Sistemas de Información Empresarial",

21 "license": "MIT",

22 "files": [

23 "bmad/**/*",

24 "siesa-agents/**/*",

25 "vscode/**/*",

26 "github/**/*",

27 "!github/workflows/**",

28 "!.github/workflows/**",

29 "!github/CODEOWNERS",

30 "!.github/CODEOWNERS",

claude/commands/get-features/oauth-login.jsView file

Lines 1-33javascript

1/**

2 * oauth-login.js

3 * OAuth 2.0 (3-legged) authentication against Atlassian / Jira

4 *

5 * Usage:

6 * node oauth-login.js

7 *

8 * - Opens the browser with the Atlassian login screen

9 * - The user enters their Jira credentials

10 * - The token is saved to tokens.json (personal per user)

11

bin/install.jsView file

Lines 40-80javascript

40}

41

42// Parse argumentos CLI básicos. Soporta:

43// --yes / -y Modo no-interactivo: usa defaults sensatos en cualquier prompt

44// en vez de leer de stdin. Defaults: "hacer backup de modificados"

45// (opción 2) y "no hay repo remoto" (opción 2). También se activa

46// automáticamente cuando stdin no es un TTY (CI, pipes).

47// --version Imprime la versión del paquete y sale.

48// --help / -h Imprime ayuda breve y sale.

49function

siesa-agents/sa/sa-skills-creator/skill-creator/eval-viewer/generate_review.pyView file

•path = siesa-agents/sa/sa-sk[redacted]/skill-creator/eval-viewer/generate_review.py kind = build_helper sizeBytes = 16365 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

siesa-agents/sa/sa-skills-creator/skill-creator/eval-viewer/generate_review.pyView on unpkg

claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.pyView file

•path = claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.py kind = payload_in_excluded_dir sizeBytes = 9245 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.pyView on unpkg

siesa-agents/observability/scripts/sa-emit.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.88 matchedPath = siesa-agents/observability/scripts/sa-emit.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.88 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/observability/scripts/sa-emit.jsView on unpkg

siesa-agents/observability/scripts/sa-init-project.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.88 matchedPath = siesa-agents/observability/scripts/sa-init-project.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.88 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/observability/scripts/sa-init-project.jsView on unpkg

siesa-agents/observability/scripts/sa-init-env.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.88 matchedPath = siesa-agents/observability/scripts/sa-init-env.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.88 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/observability/scripts/sa-init-env.jsView on unpkg