registry / nanoai-cli / 1.1.3

nanoai-cli@1.1.3

Terminal UI, ACP server, and automation-friendly CLI for NanoAgent.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 19.9 KB of source, external domains: api.github.com, github.com, us.i.posthog.com

Source & flagged code

4 flagged

package.jsonView file

Lines 10-50json

10 "cli",

11 "acp",

12 "coding-agent"

13 ],

14 "homepage": "https://github.com/rizwan3d/NanoAgent#readme",

15 "bugs": {

16 "url": "https://github.com/rizwan3d/NanoAgent/issues"

17 },

18 "repository": {

19 "type": "git",

20 "url": "git+https://github.com/rizwan3d/NanoAgent.git",

21 "directory": "packaging/npm"

22 },

23 "license": "Apache-2.0",

24 "author": "NanoAgent",

25 "type": "commonjs",

26 "bin": {

27 "nanoai": "bin/nanoai.js"

28 },

29 "scripts": {

30 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 },

32 "files": [

33 "bin/",

34 "scripts/",

35 "README.md"

36 ],

37 "engines": {

38 "node": ">=18"

39 },

40 "os": [

41 "win32",

42 "darwin",

43 "linux"

44 ],

45 "cpu": [

46 "x64",

47 "arm64"

48 ],

49 "dependencies": {

50 "@inquirer/select": "^4.4.0",

bin/nanoai.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

4const { spawn } = require("child_process");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/nanoai.jsView on unpkg · L3

6const { ensureBinary } = require("../scripts/download");

scripts/telemetry.jsView file

Lines 1-34javascript

1"use strict";

3// Best-effort, anonymous PostHog "installed" event shared by the postinstall step

4// and the runtime first-run download (covers `bun add`, which skips postinstall).

5// Telemetry must never affect installation: every failure is swallowed and the

6// network call is bounded by a short timeout. Opt out with NANOAGENT_TELEMETRY_DISABLED

7// or the cross-tool DO_NOT_TRACK convention.

9const crypto = require("crypto");

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/nanoai.jsView file

3L4: const { spawn } = require("child_process"); L5:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/nanoai.jsView on unpkg · L3

scripts/telemetry.jsView file

14// in-product analytics land in the same PostHog project. L15: const TELEMETRY_HOST = "https://us.i.posthog.com"; L16: const TELEMETRY_PROJECT_TOKEN = "phc_AKZFSyU239kkQ5GQ2y4idb8MtFX96kVekgezgnsELHRk"; ... L25: function telemetryEnabled() { L26: if (isTruthy(process.env.NANOAGENT_TELEMETRY_DISABLED) || isTruthy(process.env.DO_NOT_TRACK)) { L27: return false; ... L32: // Identify the package manager that triggered the install. npm/pnpm/yarn set L33: // npm[redacted] during their lifecycle; bun is detected from the runtime L34: // when the binary is fetched lazily on first launch. ... L106: headers: { "Content-Type": "application/json" }, L107: body: JSON.stringify(payload), L108: signal,

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/telemetry.jsView on unpkg · L14

Findings

2 High5 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilityscripts/telemetry.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/nanoai.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 10-50json

10 "cli",

11 "acp",

12 "coding-agent"

13 ],

14 "homepage": "https://github.com/rizwan3d/NanoAgent#readme",

15 "bugs": {

16 "url": "https://github.com/rizwan3d/NanoAgent/issues"

17 },

18 "repository": {

19 "type": "git",

20 "url": "git+https://github.com/rizwan3d/NanoAgent.git",

21 "directory": "packaging/npm"

22 },

23 "license": "Apache-2.0",

24 "author": "NanoAgent",

25 "type": "commonjs",

26 "bin": {

27 "nanoai": "bin/nanoai.js"

28 },

29 "scripts": {

30 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 },

32 "files": [

33 "bin/",

34 "scripts/",

35 "README.md"

36 ],

37 "engines": {

38 "node": ">=18"

39 },

40 "os": [

41 "win32",

42 "darwin",

43 "linux"

44 ],

45 "cpu": [

46 "x64",

47 "arm64"

48 ],

49 "dependencies": {

50 "@inquirer/select": "^4.4.0",

bin/nanoai.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

4const { spawn } = require("child_process");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/nanoai.jsView on unpkg · L3

6const { ensureBinary } = require("../scripts/download");

scripts/telemetry.jsView file

Lines 1-34javascript

1"use strict";

3// Best-effort, anonymous PostHog "installed" event shared by the postinstall step

4// and the runtime first-run download (covers `bun add`, which skips postinstall).

5// Telemetry must never affect installation: every failure is swallowed and the

6// network call is bounded by a short timeout. Opt out with NANOAGENT_TELEMETRY_DISABLED

7// or the cross-tool DO_NOT_TRACK convention.

9const crypto = require("crypto");