@omega3_0/nanoagent@2.1.6: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@omega3_0/nanoagent@2.1.6: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-bun.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/graph/MemoryGraph.jsView file

345if (ts.isImportDeclaration(node)) { L346: this.processTSImport(node, fileNode, sf); L347: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/graph/MemoryGraph.jsView on unpkg · L345

dist/mcp/index.jsView file

16.replace(/\{env:([^}]+)\}/g, (_, varName) => { L17: return process.env[varName] ?? ''; L18: }) ... L31: } L32: // Refuse to interpolate blocked files (workspace .env, private keys, L33: // etc.) into MCP server env/headers — that would exfiltrate secrets. ... L81: this.configs = configs ?? {}; L82: this.workspace = workspace || process.cwd(); L83: } ... L200: cwd: config.cwd ?? this.workspace, L201: // Never inherit stderr into the TUI — MCP servers (Serena especially) L202: // emit INFO logs that corrupt the OpenTUI screen.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/mcp/index.jsView on unpkg · L16

skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.shView file

•path = skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh kind = build_helper sizeBytes = 4641 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.shView on unpkg

scripts/run-nanoagent.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @omega3_0/nanoagent@2.1.5 matchedIdentity = npm:QG9tZWdhM18wL25hbm9hZ2VudA:2.1.5 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/run-nanoagent.mjsView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 51-91json

51 "node": ">=18"

52 },

53 "scripts": {

54 "nanoagent": "bun run src/main.ts",

55 "nanogent": "bun run src/main.ts",

56 "start": "bun run src/main.ts",

57 "start:tui": "bun run src/main.ts tui",

58 "start:node": "node dist/main.js",

59 "agent": "bun run src/main.ts run",

60 "typecheck": "tsc --noEmit",

61 "lint": "eslint src --ext .ts,.tsx",

62 "format": "prettier --write src",

63 "format:check": "prettier --check src",

64 "test": "bun test",

65 "test:bun": "bun test",

66 "test:security": "bun test src/security/index.test.ts",

67 "self-test": "node dist/main.js run --prompt \"run the built-in self-test\" --workspace .",

68 "ci": "npm run typecheck && npm run lint && npm run format:check && npm test && npm run build",

69 "build": "tsc -p tsconfig.json && node -e \"try{require('fs').chmodSync('dist/main.js',0o755)}catch(e){}\"",

70 "build:bun": "bun build src/main.ts src/opentui/index.tsx --outdir dist --minify --target node",

71 "postinstall": "node scripts/install-bun.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L71

72 "prepack": "npm run build",

73 "package": "npm pack",

74 "package:deb": "bash scripts/build-deb.sh",

75 "package:win": "node scripts/build-windows.mjs",

76 "package:native": "bun run package:deb && bun run package:win"

77 },

78 "devDependencies": {

79 "@types/bun": "latest",

80 "@types/diff": "^7.0.0",

81 "@types/node": "^20.14.0",

82 "@types/react": "^19",

83 "@types/react-dom": "^19",

84 "ajv": "6.12.6",

85 "bun": "^1.2.4",

86 "esbuild": "^0.24.0",

87 "eslint": "^9.0.0",

88 "prettier": "^3.0.0",

89 "typescript": "^5.6.3",

90 "typescript-eslint": "^8.65.0"

91 },

dist/graph/MemoryGraph.jsView file

Lines 325-365javascript

325 py: 'python',

326 java: 'java',

327 go: 'go',

328 rs: 'rust',

329 php

dist/mcp/index.jsView file

Lines 1-36javascript

1import { Client } from '@modelcontextprotocol/sdk/client/index.js';

2import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';

3import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';

4import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js'

skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.shView file

•path = skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh kind = build_helper sizeBytes = 4641 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.shView on unpkg

scripts/run-nanoagent.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @omega3_0/nanoagent@2.1.5 matchedIdentity = npm:QG9tZWdhM18wL25hbm9hZ2VudA:2.1.5 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/run-nanoagent.mjsView on unpkg