Loading npm security reports…

@nano-step/nano-brain@2026.7.1703: Suspicious npm security report | LPM Firewall

registry / @nano-step/nano-brain / 2026.7.1703

@nano-step/nano-brain@2026.7.1703

Persistent memory and code intelligence for AI coding agents

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 88.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source closely matched a different package identity

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 30.9 KB of source, external domains: 127.0.0.1, api.github.com, github.com

Source & flagged code

3 flagged

package.jsonView file

Lines 1-29json

2 "name": "@nano-step/nano-brain",

3 "version": "2026.7.1703",

4 "description": "Persistent memory and code intelligence for AI coding agents",

5 "bin": {

6 "nano-brain": "npm/run.js"

7 },

8 "scripts": {

9 "postinstall": "node npm/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 },

11 "publishConfig": {

12 "access": "public"

13 },

14 "repository": {

15 "type": "git",

16 "url": "git+https://github.com/nano-step/nano-brain.git"

17 },

18 "keywords": [

19 "ai",

20 "memory",

21 "mcp",

22 "coding-agent",

23 "search",

24 "pgvector"

25 ],

26 "author": "nano-step",

27 "license": "MIT",

28 "files": [

29 "npm/",

npm/postinstall.jsView file

•matchType = package_source_clone_identity_mismatch matchedPackage = nano-brain@2026.7.1105 matchedPath = npm/postinstall.js matchedIdentity = npm:bmFuby1icmFpbg:2026.7.1105 similarity = 1.000 shingleOverlap = 3 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

npm/postinstall.jsView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code