registry  /  @nano-step/nano-brain  /  2026.7.301

@nano-step/nano-brain@2026.7.301

Persistent memory and code intelligence for AI coding agents

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 88.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; source closely matched a different package identity

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 3 file(s), 23.8 KB of source, external domains: api.github.com, github.com

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.postinstall = node npm/postinstall.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node npm/postinstall.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
npm/postinstall.jsView file
•matchType = package_source_clone_identity_mismatch matchedPackage = nano-brain@2026.6.2806 matchedPath = npm/postinstall.js matchedIdentity = npm:bmFuby1icmFpbg:2026.6.2806 similarity = 1.000 shingleOverlap = 3 summary = source files closely matched a different published package identity
High
Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

npm/postinstall.jsView on unpkg

Findings

2 High4 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPackage Source Clone Identity Mismatchnpm/postinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings