Loading npm security reports…

siesa-agents@2.1.99: AI-agent control-surface risk | LPM Firewall

registry / siesa-agents / 2.1.99

siesa-agents@2.1.99

Paquete para instalar y configurar agentes SIESA en tu proyecto

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies the consumer project’s AI-agent, editor, GitHub, and MCP configuration. It also installs MCP endpoints and a command that resolves a latest-version package at later agent use.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation runs postinstall automatically.

Impact

It changes a broad AI-agent control surface without an explicit setup command and can cause later remote MCP connections or npx execution.

Mechanism

postinstall copies package-controlled agent configuration into the current project

Policy narrative

A normal npm install invokes bin/install.js through postinstall. The installer copies package-supplied directories and configuration into the consumer project, including several AI-agent control locations and .mcp.json. The added MCP configuration includes two remote services and an npx shadcn@latest command, while VS Code settings enable agent behavior and MCP discovery for other tools. This is unconsented install-time mutation of a broad AI-agent control surface.

Rationale

The package has an automatic lifecycle hook that writes broad foreign AI-agent and editor configuration into the consuming project. The installed configuration adds remote MCP access and deferred npx execution, so this is concrete install-hook abuse rather than a user-invoked setup action.

Evidence

package.jsonbin/install.jsbin/folder-mappings.jsmcp.jsonvscode/settings.json_bmad_siesa-agents

Source & flagged code

20 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

claude/commands/get-features/oauth-login.jsView file

13L14: const http = require('http'); L15: const https = require('https'); L16: const { exec } = require('child_process'); L17: const fs = require('fs'); ... L21: // Load shared configuration L22: const config = JSON.parse(fs.readFileSync(path.join(__dirname, 'oauth-config.json'))); L23: ... L42: function openBrowser(url) { L43: const platform = process.platform; L44: if (platform === 'win32') { ... L77: req.on('error', reject);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

claude/commands/get-features/oauth-login.jsView on unpkg · L13

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.98 matchedPath = claude/commands/get-features/oauth-login.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.98 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

claude/commands/get-features/oauth-login.jsView on unpkg

bin/install.jsView file

60// reemplazan completos (no se hace merge elemento-a-elemento). Pensado para L61: // `.mcp.json`: los MCPs que el usuario agregó (no existen en el paquete) sobreviven L62: // al update mientras los nativos se actualizan a la versión del paquete. ... L231: 'node_modules/', L232: '.claude/commands/get-features/oauth-config.json', L233: '.claude/commands/get-features/tokens.json', L234: '.vscode/settings.json', L235: '.claude.json' L236: ]; ... L253: L254: await fs.writeFile(gitignorePath, content, 'utf8'); L255: console.log('✓ .gitignore instalado correctamente.');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/install.jsView on unpkg · L60

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. esolve(__dirname, '..', '..', 'siesa-agents'), path.resolve(__dirname.replace(/\\bin$|\/bin$/, '')), process.cwd(), ]; for (const possiblepath of possiblepaths) { if (this.hasrequiredfolders(possiblepath)) { packagedir = possiblepath; if (debug) { console.log(` encontrado en: ${possiblepath}`); } break; } } } return packagedir; } hasrequiredfolders(dir) { return this.foldermappings.some(mapping => { const folderpath =

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/install.jsView on unpkg

siesa-agents/sa/sa-skills-creator/skill-creator/eval-viewer/generate_review.pyView file

•path = siesa-agents/sa/sa-sk[redacted]/skill-creator/eval-viewer/generate_review.py kind = build_helper sizeBytes = 16365 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

siesa-agents/sa/sa-skills-creator/skill-creator/eval-viewer/generate_review.pyView on unpkg

claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.pyView file

•path = claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.py kind = payload_in_excluded_dir sizeBytes = 9245 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

claude/skills/bmad-customize/scripts/tests/test_list_customizable_skills.pyView on unpkg

siesa-agents/observability/scripts/sa-emit.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.98 matchedPath = siesa-agents/observability/scripts/sa-emit.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.98 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/observability/scripts/sa-emit.jsView on unpkg

siesa-agents/observability/scripts/sa-init-project.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.98 matchedPath = siesa-agents/observability/scripts/sa-init-project.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.98 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/observability/scripts/sa-init-project.jsView on unpkg

siesa-agents/sa/sa-init-devops/scripts/sa-init-devops.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.98 matchedPath = siesa-agents/sa/sa-init-devops/scripts/sa-init-devops.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.98 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/sa/sa-init-devops/scripts/sa-init-devops.jsView on unpkg

siesa-agents/observability/scripts/sa-init-env.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.98 matchedPath = siesa-agents/observability/scripts/sa-init-env.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.98 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/observability/scripts/sa-init-env.jsView on unpkg

siesa-agents/scripts/jira/refresh-token.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.98 matchedPath = siesa-agents/scripts/jira/refresh-token.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.98 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/scripts/jira/refresh-token.jsView on unpkg

siesa-agents/scripts/phases/phase1.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.98 matchedPath = siesa-agents/scripts/phases/phase1.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.98 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/scripts/phases/phase1.jsView on unpkg

siesa-agents/scripts/phases/phase2.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.98 matchedPath = siesa-agents/scripts/phases/phase1.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.98 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/scripts/phases/phase2.jsView on unpkg

siesa-agents/scripts/phases/phase3.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.98 matchedPath = siesa-agents/scripts/phases/phase1.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.98 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/scripts/phases/phase3.jsView on unpkg

siesa-agents/scripts/jira/lib/jira-client.jsView file

•matchType = normalized_sha256 matchedPackage = siesa-agents@2.1.98 matchedPath = siesa-agents/scripts/jira/lib/jira-client.js matchedIdentity = npm:c2llc2EtYWdlbnRz:2.1.98 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

siesa-agents/scripts/jira/lib/jira-client.jsView on unpkg