registry / @omega3_0/nanoagent / 2.1.20
@omega3_0/nanoagent@2.1.20
Ultra-lightweight, scalable CLI/TUI coding agent optimized for tiny local models & remote runtimes
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 97.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcedist/graph/MemoryGraph.jsView file
345if (ts.isImportDeclaration(node)) {
L346: this.processTSImport(node, fileNode, sf);
L347: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/graph/MemoryGraph.jsView on unpkg · L345dist/mcp/index.jsView file
16.replace(/\{env:([^}]+)\}/g, (_, varName) => {
L17: return process.env[varName] ?? '';
L18: })
...
L31: }
L32: // Refuse to interpolate blocked files (workspace .env, private keys,
L33: // etc.) into MCP server env/headers — that would exfiltrate secrets.
...
L81: this.configs = configs ?? {};
L82: this.workspace = workspace || process.cwd();
L83: }
...
L200: cwd: config.cwd ?? this.workspace,
L201: // Never inherit stderr into the TUI — MCP servers (Serena especially)
L202: // emit INFO logs that corrupt the OpenTUI screen.
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/mcp/index.jsView on unpkg · L16skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh
Findings
5 High5 Medium5 Low
HighSemantic Analysis Limiteddist/agent/run.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/main.js
HighKnown Malware Source Similaritydist/subagents/pool.js
HighPrevious Version Dangerous Deltadist/tools/exec-tools.js
HighKnown Malware Source Similaritydist/bun-detect.js
MediumDynamic Requiredist/graph/MemoryGraph.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperskills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/mcp/index.js
Low
Affected versions and remediation
This report applies to @omega3_0/nanoagent@2.1.20.
See all versions of @omega3_0/nanoagent for other recorded verdicts.
- Review the evidence and your use of @omega3_0/nanoagent@2.1.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.