registry / @omega3_0/nanoagent / 2.1.13
@omega3_0/nanoagent@2.1.13
Ultra-lightweight, scalable CLI/TUI coding agent optimized for tiny local models & remote runtimes
AI Security Review
scanned 2mo ago · by lpm-firewall-aiDirect inspection found no lifecycle hook or covert payload. The flagged primitives support the documented coding-agent runtime and are guarded by user interaction, permissions, MCP trust controls, and environment filtering.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
User runs the CLI/TUI; Bun installation additionally requires interactive y/yes confirmation.
Impact
Expected agent capabilities within user configuration and permission controls; no concrete unconsented malicious chain found.
Mechanism
User-invoked coding-agent command, file, LLM, and MCP tooling.
AI rationale
Direct inspection found no lifecycle hook or covert payload. The flagged primitives support the documented coding-agent runtime and are guarded by user interaction, permissions, MCP trust controls, and environment filtering.
Evidence
package.jsonscripts/run-nanoagent.mjsdist/main.jsdist/bun-detect.jsdist/tools/exec-tools.jsdist/mcp/index.jsdist/agent-lifecycle.jsdist/tools/shared.js
Network endpoints1
bun.sh/install
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- No npm preinstall/install/postinstall hook is declared.
- Bun download-and-shell execution is reachable only after an interactive y/yes response at runtime.
- Project-local MCP servers are disabled unless explicitly trusted.
- Child-process environments filter key, token, password, credential, auth, API, and private variables.
Evidence against
- No import-time payload, credential harvesting, or undisclosed exfiltration found in inspected entrypoints.
- Network use is package-aligned: configured LLM/MCP endpoints and optional user-approved Bun installation.
- The package is an interactive coding agent, so workspace command/file capabilities are user-invoked and permission-gated.
- Memory graph writes are limited to the workspace .qwen-graph directory.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcedist/graph/MemoryGraph.jsView file
345if (ts.isImportDeclaration(node)) {
L346: this.processTSImport(node, fileNode, sf);
L347: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/graph/MemoryGraph.jsView on unpkg · L345dist/mcp/index.jsView file
16.replace(/\{env:([^}]+)\}/g, (_, varName) => {
L17: return process.env[varName] ?? '';
L18: })
...
L31: }
L32: // Refuse to interpolate blocked files (workspace .env, private keys,
L33: // etc.) into MCP server env/headers — that would exfiltrate secrets.
...
L81: this.configs = configs ?? {};
L82: this.workspace = workspace || process.cwd();
L83: }
...
L200: cwd: config.cwd ?? this.workspace,
L201: // Never inherit stderr into the TUI — MCP servers (Serena especially)
L202: // emit INFO logs that corrupt the OpenTUI screen.
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/mcp/index.jsView on unpkg · L16skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh
Findings
4 High5 Medium5 Low
HighKnown Malware Source Similaritydist/tools/exec-tools.js
HighKnown Malware Source Similaritydist/main.js
HighKnown Malware Source Similaritydist/subagents/pool.js
HighKnown Malware Source Similaritydist/bun-detect.js
MediumDynamic Requiredist/graph/MemoryGraph.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperskills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/mcp/index.js
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @omega3_0/nanoagent@2.1.13.
See all versions of @omega3_0/nanoagent for other recorded verdicts.
- Review the evidence and your use of @omega3_0/nanoagent@2.1.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.