@omega3_0/nanoagent@2.1.7
Ultra-lightweight, scalable CLI/TUI coding agent optimized for tiny local models & remote runtimes
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains a concrete, unprompted postinstall remote-code execution path. Its apparent runtime-bootstrap purpose reduces intent certainty but does not remove the supply-chain execution risk. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
npm install on a host without Bun available on PATH.
Impact
Remote content from the Bun installer endpoint executes with the installing user’s privileges.
Mechanism
postinstall curl/PowerShell download piped directly to a shell
AI rationale
The package contains a concrete, unprompted postinstall remote-code execution path. Its apparent runtime-bootstrap purpose reduces intent certainty but does not remove the supply-chain execution risk. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.
Evidence
package.jsonscripts/install-bun.mjsdist/bun-detect.jsdist/tools/exec-tools.jsdist/tools/shared.jsdist/security/index.jsdist/providers/runtime.js
Network endpoints2
bun.sh/installbun.sh/install.ps1
Decision evidence
public snapshotAI called this Suspicious at 98.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- package.json registers an automatic postinstall hook.
- The hook executes a remotely fetched Bun installer through a shell when Bun is absent.
- The install-time download is unauthenticated and has no pinned integrity check.
Evidence against
- The remote endpoint is Bun’s public installer, consistent with the package’s declared Bun-based TUI runtime.
- Runtime command execution is an advertised coding-agent feature and includes command/path safeguards.
- No package-owned credential exfiltration, stealth persistence, or foreign AI-agent config mutation was found in inspected files.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-bun.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/graph/MemoryGraph.jsView file
345if (ts.isImportDeclaration(node)) {
L346: this.processTSImport(node, fileNode, sf);
L347: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/graph/MemoryGraph.jsView on unpkg · L345dist/mcp/index.jsView file
16.replace(/\{env:([^}]+)\}/g, (_, varName) => {
L17: return process.env[varName] ?? '';
L18: })
...
L31: }
L32: // Refuse to interpolate blocked files (workspace .env, private keys,
L33: // etc.) into MCP server env/headers — that would exfiltrate secrets.
...
L81: this.configs = configs ?? {};
L82: this.workspace = workspace || process.cwd();
L83: }
...
L200: cwd: config.cwd ?? this.workspace,
L201: // Never inherit stderr into the TUI — MCP servers (Serena especially)
L202: // emit INFO logs that corrupt the OpenTUI screen.
Findings
6 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritydist/bun-detect.js
HighKnown Malware Source Similaritydist/tools/exec-tools.js
HighKnown Malware Source Similarityscripts/run-nanoagent.mjs
HighKnown Malware Source Similarityscripts/install-bun.mjs
HighKnown Malware Source Similaritydist/main.js
MediumDynamic Requiredist/graph/MemoryGraph.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperskills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
Affected versions and remediation
This report applies to @omega3_0/nanoagent@2.1.7.
See all versions of @omega3_0/nanoagent for other recorded verdicts.
- Review the evidence and your use of @omega3_0/nanoagent@2.1.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.