registry / @omega3_0/nanoagent / 2.1.2

@omega3_0/nanoagent@2.1.2

Ultra-lightweight, scalable CLI/TUI coding agent optimized for tiny local models & remote runtimes

AI Security Review

scanned 5d ago · by lpm-firewall-ai

npm installation automatically fetches and executes a remote Bun installer. This is a supply-chain remote-code-execution risk, not evidence of a package-owned payload.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install of this package where bun is unavailable

Impact

Remote bun.sh content executes with the installer user's privileges.

Mechanism

postinstall curl/PowerShell pipe-to-shell runtime bootstrap

Rationale

Automatic unpinned remote shell execution at install time is a concrete high-risk capability, but inspected source supports a runtime-bootstrap purpose rather than confirmed malicious intent. Warn rather than block.

Evidence

package.jsonscripts/install-bun.mjsdist/bun-detect.jsdist/agent-lifecycle.jsdist/mcp/index.js

Network endpoints2

bun.sh/installbun.sh/install.ps1

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

@omega3_0/nanoagent@2.1.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code