registry / Remote code execution / @omega3_0/nanoagent
@omega3_0/nanoagent
Ultra-lightweight, scalable CLI/TUI coding agent optimized for tiny local models & remote runtimes
This report shows the evidence for @omega3_0/nanoagent@2.1.9. 3 of 50 known versions are blocked or flagged. The newest version, 2.7.22, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe automatic lifecycle hook creates a concrete unconsented remote-code-execution chain. Its apparent runtime-bootstrap purpose does not mitigate executing mutable network content during installation.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm install when Bun is not already available
Impact
Remote content can execute arbitrary commands with the installing user's privileges.
Mechanism
postinstall remote shell execution
Attack narrative
During npm install, the postinstall hook runs scripts/install-bun.mjs. If `bun --version` fails, it uses `curl -fsSL https://bun.sh/install | bash` on Unix or PowerShell `irm ... | iex` on Windows. This executes unpinned remote content before the user runs the CLI, with no hash/signature validation or confirmation.
AI rationale
The automatic lifecycle hook creates a concrete unconsented remote-code-execution chain. Its apparent runtime-bootstrap purpose does not mitigate executing mutable network content during installation.
Evidence
package.jsonscripts/install-bun.mjsscripts/run-nanoagent.mjsdist/bun-detect.jsdist/main.jsdist/tools/exec-tools.jsdist/graph/MemoryGraph.js
Network endpoints2
bun.sh/installbun.sh/install.ps1
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs scripts/install-bun.mjs automatically as postinstall.
- Installer executes a downloaded Bun installer through curl|bash or PowerShell irm|iex when Bun is absent.
- No checksum, signature verification, pinning, or user confirmation protects this install-time remote execution.
Evidence against
- The inspected launcher only selects Bun/Node package entrypoints.
- No credential exfiltration was found in the inspected lifecycle and launcher code.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-bun.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/graph/MemoryGraph.jsView file
345if (ts.isImportDeclaration(node)) {
L346: this.processTSImport(node, fileNode, sf);
L347: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/graph/MemoryGraph.jsView on unpkg · L345dist/mcp/index.jsView file
16.replace(/\{env:([^}]+)\}/g, (_, varName) => {
L17: return process.env[varName] ?? '';
L18: })
...
L31: }
L32: // Refuse to interpolate blocked files (workspace .env, private keys,
L33: // etc.) into MCP server env/headers — that would exfiltrate secrets.
...
L81: this.configs = configs ?? {};
L82: this.workspace = workspace || process.cwd();
L83: }
...
L200: cwd: config.cwd ?? this.workspace,
L201: // Never inherit stderr into the TUI — MCP servers (Serena especially)
L202: // emit INFO logs that corrupt the OpenTUI screen.
Findings
6 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritydist/bun-detect.js
HighKnown Malware Source Similarityscripts/run-nanoagent.mjs
HighKnown Malware Source Similarityscripts/install-bun.mjs
HighKnown Malware Source Similaritydist/main.js
HighPrevious Version Dangerous Deltadist/tools/exec-tools.js
MediumDynamic Requiredist/graph/MemoryGraph.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperskills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
Affected versions and remediation
This report applies to @omega3_0/nanoagent@2.1.9.
The versions list below shows the verdict for each recorded version.
- Avoid installing @omega3_0/nanoagent@2.1.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.