Loading npm security reports…

siesa-agents@2.1.98: AI-agent control-surface risk | LPM Firewall

registry / siesa-agents / 2.1.98

siesa-agents@2.1.98

Paquete para instalar y configurar agentes SIESA en tu proyecto

AI Security Review

scanned 8h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm installation automatically writes a broad set of AI-agent and editor control files into the consuming project. It installs Claude permissions/hooks and MCP server definitions before any explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall

Impact

Can grant agent shell capabilities, install remote/local MCP providers, and cause session metadata/token telemetry to be collected during later agent use.

Mechanism

recursive copying of agent configuration and executable hooks into project control surfaces

Policy narrative

Installing the package runs its installer automatically. The installer copies package-controlled content into several project control surfaces, including Claude settings and MCP configuration. The Claude settings pre-authorize shell actions and register a SessionStart hook. It also installs remote MCP definitions and an npx-based MCP command. The hook records session metadata, while later workflow commands can read transcript usage and send telemetry to a configured OTLP endpoint.

Rationale

This is an unconsented postinstall mutation of broad AI-agent control surfaces, including permissive Claude settings, hooks, and remote MCP configuration. The lifecycle behavior meets the firewall block boundary even though direct credential exfiltration was not observed.

Evidence

package.jsonbin/install.jsbin/folder-mappings.jsclaude/settings.local.jsonmcp.jsonsiesa-agents/observability/scripts/sa-session.js

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

claude/commands/get-features/oauth-login.jsView file

13L14: const http = require('http'); L15: const https = require('https'); L16: const { exec } = require('child_process'); L17: const fs = require('fs'); ... L21: // Load shared configuration L22: const config = JSON.parse(fs.readFileSync(path.join(__dirname, 'oauth-config.json'))); L23: ... L42: function openBrowser(url) { L43: const platform = process.platform; L44: if (platform === 'win32') { ... L77: req.on('error', reject);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

claude/commands/get-features/oauth-login.jsView on unpkg · L13

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.96 matchedPath = claude/commands/get-features/oauth-login.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.96 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

claude/commands/get-features/oauth-login.jsView on unpkg

bin/install.jsView file

60// reemplazan completos (no se hace merge elemento-a-elemento). Pensado para L61: // `.mcp.json`: los MCPs que el usuario agregó (no existen en el paquete) sobreviven L62: // al update mientras los nativos se actualizan a la versión del paquete. ... L231: 'node_modules/', L232: '.claude/commands/get-features/oauth-config.json', L233: '.claude/commands/get-features/tokens.json', L234: '.vscode/settings.json', L235: '.claude.json' L236: ]; ... L253: L254: await fs.writeFile(gitignorePath, content, 'utf8'); L255: console.log('✓ .gitignore instalado correctamente.');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/install.jsView on unpkg · L60

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. esolve(__dirname, '..', '..', 'siesa-agents'), path.resolve(__dirname.replace(/\\bin$|\/bin$/, '')), process.cwd(), ]; for (const possiblepath of possiblepaths) { if (this.hasrequiredfolders(possiblepath)) { packagedir = possiblepath; if (debug) { console.log(` encontrado en: ${possiblepath}`); } break; } } } return packagedir; } hasrequiredfolders(dir) { return this.foldermappings.some(mapping => { const folderpath =

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/install.jsView on unpkg

siesa-agents/sa/sa-skills-creator/skill-creator/eval-viewer/generate_review.pyView file

•path = siesa-agents/sa/sa-sk[redacted]/skill-creator/eval-viewer/generate_review.py kind = build_helper sizeBytes = 16365 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

siesa-agents/sa/sa-skills-creator/skill-creator/eval-viewer/generate_review.pyView on unpkg

claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.pyView file

•path = claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.py kind = payload_in_excluded_dir sizeBytes = 9245 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.pyView on unpkg

siesa-agents/observability/scripts/sa-emit.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.96 matchedPath = siesa-agents/observability/scripts/sa-emit.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.96 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/observability/scripts/sa-emit.jsView on unpkg

siesa-agents/observability/scripts/sa-init-project.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.96 matchedPath = siesa-agents/observability/scripts/sa-init-project.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.96 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/observability/scripts/sa-init-project.jsView on unpkg

siesa-agents/sa/sa-init-devops/scripts/sa-init-devops.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.96 matchedPath = siesa-agents/sa/sa-init-devops/scripts/sa-init-devops.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.96 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/sa/sa-init-devops/scripts/sa-init-devops.jsView on unpkg

siesa-agents/observability/scripts/sa-init-env.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.96 matchedPath = siesa-agents/observability/scripts/sa-init-env.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.96 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/observability/scripts/sa-init-env.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 1-30json

1{

2 "name": "siesa-agents",

3 "version": "2.1.98",

4 "description": "Paquete para instalar y configurar agentes SIESA en tu proyecto",

5 "main": "index.js",

6 "bin": {

7 "siesa-agents": "./bin/install.js"

8 },

9 "scripts": {

10 "postinstall": "node ./bin/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 "build": "echo 'Build complete'"

12 },

13 "keywords": [

14 "siesa",

15 "bmad",

16 "agents",

17 "automation",

18 "cli"

19 ],

20 "author": "Sistemas de Información Empresarial",

21 "license": "MIT",

22 "files": [

23 "bmad/**/*",

24 "siesa-agents/**/*",

25 "vscode/**/*",

26 "github/**/*",

27 "!github/workflows/**",

28 "!.github/workflows/**",

29 "!github/CODEOWNERS",

30 "!.github/CODEOWNERS",

claude/commands/get-features/oauth-login.jsView file

Lines 1-33javascript

1/**

2 * oauth-login.js

3 * OAuth 2.0 (3-legged) authentication against Atlassian / Jira

4 *

5 * Usage:

6 * node oauth-login.js

7 *

8 * - Opens the browser with the Atlassian login screen

9 * - The user enters their Jira credentials

10 * - The token is saved to tokens.json (personal per user)

11

bin/install.jsView file

Lines 40-80javascript

40}

41

42// Parse argumentos CLI básicos. Soporta:

43// --yes / -y Modo no-interactivo: usa defaults sensatos en cualquier prompt

44// en vez de leer de stdin. Defaults: "hacer backup de modificados"

45// (opción 2) y "no hay repo remoto" (opción 2). También se activa

46// automáticamente cuando stdin no es un TTY (CI, pipes).

47// --version Imprime la versión del paquete y sale.

48// --help / -h Imprime ayuda breve y sale.

49function

siesa-agents/sa/sa-skills-creator/skill-creator/eval-viewer/generate_review.pyView file

•path = siesa-agents/sa/sa-sk[redacted]/skill-creator/eval-viewer/generate_review.py kind = build_helper sizeBytes = 16365 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

siesa-agents/sa/sa-skills-creator/skill-creator/eval-viewer/generate_review.pyView on unpkg

claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.pyView file

•path = claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.py kind = payload_in_excluded_dir sizeBytes = 9245 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.pyView on unpkg

siesa-agents/observability/scripts/sa-emit.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.96 matchedPath = siesa-agents/observability/scripts/sa-emit.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.96 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/observability/scripts/sa-emit.jsView on unpkg

siesa-agents/observability/scripts/sa-init-project.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.96 matchedPath = siesa-agents/observability/scripts/sa-init-project.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.96 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/observability/scripts/sa-init-project.jsView on unpkg

siesa-agents/sa/sa-init-devops/scripts/sa-init-devops.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.96 matchedPath = siesa-agents/sa/sa-init-devops/scripts/sa-init-devops.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.96 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/sa/sa-init-devops/scripts/sa-init-devops.jsView on unpkg

siesa-agents/observability/scripts/sa-init-env.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.96 matchedPath = siesa-agents/observability/scripts/sa-init-env.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.96 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/observability/scripts/sa-init-env.jsView on unpkg