Loading npm security reports…

micro-models-agent@0.2.19: Suspicious npm security report (Warn) | LPM Firewall

registry / micro-models-agent / 0.2.19

micro-models-agent@0.2.19

Micro Models Agent (MMA) — LLM agent harness for small models (Qwen3.5-9B, 32K-64K context)

Static Scan Results

scanned 2h ago · by rust-scanner

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 65 file(s), 277 KB of source, external domains: example.com, lite.duckduckgo.com

Source & flagged code

4 flagged

dist/ui/opentui-renderer.jsView file

Lines 1-21javascript

1import { execSync } from 'node:child_process';

2import { formatStatusLine } from './components/status-bar.js';

High

Child Process

Package source references child process execution.

dist/ui/opentui-renderer.jsView on unpkg · L1

3import { DoublePressDetector } from './double-press.js';

4let _Text;

5let _Box;

6let _TextareaRenderable;

7let _ScrollBox;

8let _MarkdownRenderable;

9let _SyntaxStyle;

10async function loadOpentui() {

11 const mod = await import('@opentui/core');

12 _Text = mod.Text;

13 _Box = mod.Box;

14 _TextareaRenderable = mod.TextareaRenderable;

15 _ScrollBox = mod.ScrollBox;

16 _MarkdownRenderable = mod.MarkdownRenderable;

17 _SyntaxStyle = mod.SyntaxStyle;

18 return mod;

19}

20const theme = {

21 bg: '#1a1b26',

dist/tools/bash.jsView file

Lines 1-21javascript

1import { execa, ExecaError } from 'execa';

2import { writeFileSync, existsSync, mkdirSync } from 'node:fs';

High

Shell

Package source references shell execution.

dist/tools/bash.jsView on unpkg · L1

3import { join } from 'node:path';

4import

dist/tools/syntax-check.jsView file

Lines 1-32javascript

1import { execSync } from 'node:child_process';

2import { readFileSync, existsSync } from 'node:fs';

3import { join } from 'node:path';

4import { createRequire } from 'node:module';

dist/repl/commands.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = micro-models-agent@0.2.16 matchedIdentity = npm:bWljcm8tbW9kZWxzLWFnZW50:0.2.16 similarity = 0.914 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/repl/commands.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/ui/opentui-renderer.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code