registry / @omega3_0/nanoagent / 2.1.11
@omega3_0/nanoagent@2.1.11
Ultra-lightweight, scalable CLI/TUI coding agent optimized for tiny local models & remote runtimes
AI Security Review
scanned 2mo ago · by lpm-firewall-aiDirect inspection found no install-time lifecycle execution, credential theft, stealth persistence, or unconsented agent-control mutation. Flagged primitives implement the package's stated interactive coding-agent functionality with meaningful guards.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
User runs the CLI/TUI, configures an LLM/MCP endpoint, or approves an agent command.
Impact
May execute user-approved workspace commands and send prompts to user-configured model services; no covert persistence or exfiltration found.
Mechanism
Interactive coding-agent execution and configured LLM/MCP connectivity.
AI rationale
Direct inspection found no install-time lifecycle execution, credential theft, stealth persistence, or unconsented agent-control mutation. Flagged primitives implement the package's stated interactive coding-agent functionality with meaningful guards.
Evidence
package.jsondist/main.jsdist/tools/exec-tools.jsdist/tools/shared.jsdist/security/permissions.jsdist/agent-lifecycle.jsdist/mcp/index.jsdist/subagents/pool.jsscripts/run-nanoagent.mjsdist/bun-detect.js
Network endpoints2
127.0.0.1:1234/v1openrouter.ai/api/v1/models
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Bun installation is only reached after interactive y/yes confirmation.
- The agent intentionally exposes a workspace shell tool, with command permission checks.
- Network use is for configured/local LLM and MCP endpoints.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare hook.
- No credential harvesting or hidden exfiltration path found.
- Child-process use supports the declared CLI/agent runtime and has permission and destructive-command checks.
- Project-local MCP servers are blocked from automatic connection.
- Child-process environments omit variables matching secret/key/token patterns.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
8 flagged · loading sourcedist/graph/MemoryGraph.jsView file
345if (ts.isImportDeclaration(node)) {
L346: this.processTSImport(node, fileNode, sf);
L347: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/graph/MemoryGraph.jsView on unpkg · L345dist/mcp/index.jsView file
16.replace(/\{env:([^}]+)\}/g, (_, varName) => {
L17: return process.env[varName] ?? '';
L18: })
...
L31: }
L32: // Refuse to interpolate blocked files (workspace .env, private keys,
L33: // etc.) into MCP server env/headers — that would exfiltrate secrets.
...
L81: this.configs = configs ?? {};
L82: this.workspace = workspace || process.cwd();
L83: }
...
L200: cwd: config.cwd ?? this.workspace,
L201: // Never inherit stderr into the TUI — MCP servers (Serena especially)
L202: // emit INFO logs that corrupt the OpenTUI screen.
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/mcp/index.jsView on unpkg · L16skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh
Findings
5 High6 Medium5 Low
HighKnown Malware Source Similaritydist/tools/exec-tools.js
HighKnown Malware Source Similaritydist/main.js
HighKnown Malware Source Similaritydist/subagents/pool.js
HighPrevious Version Dangerous Deltadist/bun-detect.js
HighKnown Malware Source Similaritydist/bun-detect.js
MediumDynamic Requiredist/graph/MemoryGraph.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperskills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowScripts Present
LowWeak Cryptodist/mcp/index.js
Affected versions and remediation
This report applies to @omega3_0/nanoagent@2.1.11.
See all versions of @omega3_0/nanoagent for other recorded verdicts.
- Review the evidence and your use of @omega3_0/nanoagent@2.1.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.