Loading npm security reports…

micro-models-agent@0.2.25: Suspicious npm security report (Warn) | LPM Firewall

registry / micro-models-agent / 0.2.25

micro-models-agent@0.2.25

Micro Models Agent (MMA) — LLM agent harness for small models (Qwen3.5-9B, 32K-64K context)

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 66 file(s), 293 KB of source, external domains: api.together.xyz, example.com, huggingface.co, lite.duckduckgo.com

Source & flagged code

3 flagged

dist/ui/opentui-renderer.jsView file

Lines 1-21javascript

1import { execSync } from 'node:child_process';

2import { formatStatusLine } from './components/status-bar.js';

High

Child Process

Package source references child process execution.

dist/ui/opentui-renderer.jsView on unpkg · L1

3import { DoublePressDetector } from './double-press.js';

4let _Text;

5let _Box;

6let _TextareaRenderable;

7let _ScrollBox;

8let _MarkdownRenderable;

9let _SyntaxStyle;

10async function loadOpentui() {

11 const mod = await import('@opentui/core');

12 _Text = mod.Text;

13 _Box = mod.Box;

14 _TextareaRenderable = mod.TextareaRenderable;

15 _ScrollBox = mod.ScrollBox;

16 _MarkdownRenderable = mod.MarkdownRenderable;

17 _SyntaxStyle = mod.SyntaxStyle;

18 return mod;

19}

20const theme = {

21 bg: '#1a1b26',

dist/tools/bash.jsView file

Lines 1-21javascript

1import { execa, ExecaError } from 'execa';

2import { writeFileSync, existsSync, mkdirSync } from 'node:fs';

High

Shell

Package source references shell execution.

dist/tools/bash.jsView on unpkg · L1

3import { join } from 'node:path';

4import

dist/tools/syntax-check.jsView file

Lines 1-32javascript

1import { execSync } from 'node:child_process';

2import { readFileSync, existsSync } from 'node:fs';

3import { join } from 'node:path';

4import { createRequire } from 'node:module';

Source & flagged code

3 flagged · loading source

dist/ui/opentui-renderer.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code