registry / @omega3_0/nanoagent / 2.1.5

@omega3_0/nanoagent@2.1.5

Ultra-lightweight, scalable CLI/TUI coding agent optimized for tiny local models & remote runtimes

AI Security Review

scanned 2d ago · by lpm-firewall-ai

Installation automatically fetches and executes a remote Bun installer. This is an unpinned remote-code execution supply-chain surface, though no separate malicious payload was found in inspected package code.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation

Impact

A compromise or change of bun.sh could execute arbitrary commands as the installing user.

Mechanism

postinstall curl/powershell pipe-to-shell

Rationale

The package contains a concrete unconsented install-time remote execution primitive. Inspected runtime and security code appears package-aligned and does not establish independent malicious intent or exfiltration.

Evidence

package.jsonscripts/install-bun.mjsdist/main.jsdist/config/load.jsdist/security/index.jsdist/mcp/index.js

Network endpoints2

bun.sh/installbun.sh/install.ps1

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

@omega3_0/nanoagent@2.1.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code