registry / @omega3_0/nanoagent / 1.1.2

@omega3_0/nanoagent@1.1.2

Ultra-lightweight, scalable CLI/TUI coding agent optimized for tiny local models & remote runtimes

AI Security Review

scanned 7d ago · by lpm-firewall-ai

Installation automatically downloads and executes a remote Bun installation script. No confirmed credential theft, destructive action, or AI-agent control-surface modification was found.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation when Bun is absent

Impact

An upstream change or network compromise of the Bun installer can execute code with the installing user's privileges.

Mechanism

postinstall remote shell-script execution

Rationale

The automatic unpinned remote installer is a real supply-chain risk and warrants warning. Source inspection does not establish malicious intent or a concrete data-theft/destructive chain.

Evidence

package.jsonscripts/install-bun.mjsdist/bun-detect.jsdist/mcp/index.jsdist/config/api-keys.jsdist/llm/utils.js

Network endpoints2

bun.sh/installbun.sh/install.ps1

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with false-positive risk.

@omega3_0/nanoagent@1.1.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code