registry / @omega3_0/nanoagent / 2.7.2
@omega3_0/nanoagent@2.7.2
⚠ Under reviewUltra-lightweight, scalable CLI/TUI coding agent optimized for tiny local models & remote runtimes
Static Scan Results
scanned 1mo ago · by rust-scannerStatic analysis completed at 97.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcescripts/run-nanoagent.mjsView file
288}
L289: await import(pathToFileURL(launch.entry).href);
L290: return;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/run-nanoagent.mjsView on unpkg · L288dist/mcp/index.jsView file
16.replace(/\{env:([^}]+)\}/g, (_, varName) => {
L17: return process.env[varName] ?? '';
L18: })
...
L31: }
L32: // Refuse to interpolate blocked files (workspace .env, private keys,
L33: // etc.) into MCP server env/headers — that would exfiltrate secrets.
...
L81: this.configs = configs ?? {};
L82: this.workspace = workspace || process.cwd();
L83: }
...
L200: cwd: config.cwd ?? this.workspace,
L201: // Never inherit stderr into the TUI — MCP servers (Serena especially)
L202: // emit INFO logs that corrupt the OpenTUI screen.
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/mcp/index.jsView on unpkg · L16skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh
Findings
4 High5 Medium5 Low
HighSemantic Analysis Limiteddist/agent/run.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/subagents/pool.js
HighKnown Malware Source Similaritydist/bun-detect.js
HighPrevious Version Dangerous Deltadist/main.js
MediumDynamic Requirescripts/run-nanoagent.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperskills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/mcp/index.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @omega3_0/nanoagent@2.7.2.
See all versions of @omega3_0/nanoagent for other recorded verdicts.
- Review the evidence and your use of @omega3_0/nanoagent@2.7.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.