@omega3_0/nanoagent@2.1.10
Ultra-lightweight, scalable CLI/TUI coding agent optimized for tiny local models & remote runtimes
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe automatic unpinned remote installer is a concrete install-time risk, but the inspected source does not establish malicious intent or a package-specific attack chain. Downgrade to warn rather than block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
npm install when the Bun command is unavailable
Impact
Remote content served by bun.sh runs with the installing user's privileges.
Mechanism
postinstall executes curl/PowerShell pipe-to-shell
AI rationale
The automatic unpinned remote installer is a concrete install-time risk, but the inspected source does not establish malicious intent or a package-specific attack chain. Downgrade to warn rather than block.
Evidence
package.jsonscripts/install-bun.mjsdist/agent-lifecycle.jsdist/mcp/index.jsdist/tools/shared.js
Network endpoints2
bun.sh/installbun.sh/install.ps1
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json invokes a postinstall helper.
- When Bun is absent, that helper executes an unpinned remote curl-to-bash installer during npm installation.
Evidence against
- The install helper targets only bun.sh and reports failure without blocking installation.
- Runtime network endpoints are configured LLM/MCP providers or user-supplied URLs, not hidden exfiltration.
- MCP startup blocks project-local server auto-connection and strips sensitive environment variables for local MCP processes.
- No direct credential collection or unrelated destructive action was found in inspected files.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-bun.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/graph/MemoryGraph.jsView file
345if (ts.isImportDeclaration(node)) {
L346: this.processTSImport(node, fileNode, sf);
L347: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/graph/MemoryGraph.jsView on unpkg · L345dist/mcp/index.jsView file
16.replace(/\{env:([^}]+)\}/g, (_, varName) => {
L17: return process.env[varName] ?? '';
L18: })
...
L31: }
L32: // Refuse to interpolate blocked files (workspace .env, private keys,
L33: // etc.) into MCP server env/headers — that would exfiltrate secrets.
...
L81: this.configs = configs ?? {};
L82: this.workspace = workspace || process.cwd();
L83: }
...
L200: cwd: config.cwd ?? this.workspace,
L201: // Never inherit stderr into the TUI — MCP servers (Serena especially)
L202: // emit INFO logs that corrupt the OpenTUI screen.
Findings
6 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritydist/bun-detect.js
HighKnown Malware Source Similaritydist/tools/exec-tools.js
HighKnown Malware Source Similarityscripts/run-nanoagent.mjs
HighKnown Malware Source Similaritydist/main.js
HighKnown Malware Source Similaritydist/subagents/pool.js
MediumDynamic Requiredist/graph/MemoryGraph.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperskills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
Affected versions and remediation
This report applies to @omega3_0/nanoagent@2.1.10.
See all versions of @omega3_0/nanoagent for other recorded verdicts.
- Review the evidence and your use of @omega3_0/nanoagent@2.1.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.