@omega3_0/nanoagent@2.1.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@omega3_0/nanoagent@2.1.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-bun.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/graph/MemoryGraph.jsView file

345if (ts.isImportDeclaration(node)) { L346: this.processTSImport(node, fileNode, sf); L347: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/graph/MemoryGraph.jsView on unpkg · L345

dist/mcp/index.jsView file

16.replace(/\{env:([^}]+)\}/g, (_, varName) => { L17: return process.env[varName] ?? ''; L18: }) ... L31: } L32: // Refuse to interpolate blocked files (workspace .env, private keys, L33: // etc.) into MCP server env/headers — that would exfiltrate secrets. ... L81: this.configs = configs ?? {}; L82: this.workspace = workspace || process.cwd(); L83: } ... L200: cwd: config.cwd ?? this.workspace, L201: // Never inherit stderr into the TUI — MCP servers (Serena especially) L202: // emit INFO logs that corrupt the OpenTUI screen.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/mcp/index.jsView on unpkg · L16

dist/tree-sitter-markdown_inline-j5349f42.wasmView file

•path = dist/tree-sitter-markdown_inline-j5349f42.wasm kind = wasm_module sizeBytes = 426020 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/tree-sitter-markdown_inline-j5349f42.wasmView on unpkg

skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.shView file

•path = skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh kind = build_helper sizeBytes = 4641 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.shView on unpkg

dist/subagents/pool.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @omega3_0/nanoagent@1.1.3 matchedIdentity = npm:QG9tZWdhM18wL25hbm9hZ2VudA:1.1.3 similarity = 0.924 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/subagents/pool.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 50-90json

50 "node": ">=18"

51 },

52 "scripts": {

53 "nanoagent": "bun run src/main.ts",

54 "nanogent": "bun run src/main.ts",

55 "start": "bun run src/main.ts",

56 "start:tui": "bun run src/main.ts tui",

57 "start:node": "node dist/main.js",

58 "agent": "bun run src/main.ts run",

59 "typecheck": "tsc --noEmit",

60 "lint": "eslint src --ext .ts,.tsx",

61 "format": "prettier --write src",

62 "format:check": "prettier --check src",

63 "test": "bun test",

64 "test:bun": "bun test",

65 "test:security": "bun test src/security/index.test.ts",

66 "self-test": "node dist/main.js run --prompt \"run the built-in self-test\" --workspace .",

67 "ci": "npm run typecheck && npm run lint && npm run format:check && npm test && npm run build",

68 "build": "tsc -p tsconfig.json && node -e \"try{require('fs').chmodSync('dist/main.js',0o755)}catch(e){}\"",

69 "build:bun": "bun build src/main.ts src/opentui/index.tsx --outdir dist --minify --target node",

70 "postinstall": "node scripts/install-bun.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L70

71 "prepack": "npm run build",

72 "package": "npm pack"

73 },

74 "devDependencies": {

75 "@types/bun": "latest",

76 "@types/diff": "^7.0.0",

77 "@types/node": "^20.14.0",

78 "@types/react": "^19",

79 "@types/react-dom": "^19",

80 "ajv": "6.12.6",

81 "bun": "^1.2.4",

82 "esbuild": "^0.24.0",

83 "eslint": "^9.0.0",

84 "prettier": "^3.0.0",

85 "typescript": "^5.6.3",

86 "typescript-eslint": "^8.65.0"

87 },

88 "dependencies": {

89 "@modelcontextprotocol/sdk": "^1.29.0",

90 "@openrouter/sdk": "^0.13.7",

dist/graph/MemoryGraph.jsView file

Lines 325-365javascript

325 py: 'python',

326 java: 'java',

327 go: 'go',

328 rs: 'rust',

329 php

dist/mcp/index.jsView file

Lines 1-36javascript

1import { Client } from '@modelcontextprotocol/sdk/client/index.js';

2import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';

3import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';

4import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js'

dist/tree-sitter-markdown_inline-j5349f42.wasmView file

•path = dist/tree-sitter-markdown_inline-j5349f42.wasm kind = wasm_module sizeBytes = 426020 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/tree-sitter-markdown_inline-j5349f42.wasmView on unpkg

skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.shView file

•path = skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh kind = build_helper sizeBytes = 4641 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.shView on unpkg

dist/subagents/pool.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @omega3_0/nanoagent@1.1.3 matchedIdentity = npm:QG9tZWdhM18wL25hbm9hZ2VudA:1.1.3 similarity = 0.924 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/subagents/pool.jsView on unpkg