registry / nanocorp / 0.3.8

nanocorp@0.3.8

NanoCorp CLI: create and run your autonomous company from the terminal.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The npm postinstall hook automatically invokes the bundled CLI to install NanoCorp skills for supported coding agents.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package with lifecycle scripts enabled, unless NANOCORP_NO_AGENT_SKILLS is set.

Impact

Agent skill directories may be modified during installation. No further attack behavior was established from the inspected source.

Mechanism

The hook starts the package launcher with `skills install --quiet`; the launcher delegates to a platform-specific bundled binary. The binary's implementation could not be inspected as source.

AI rationale

The postinstall hook automatically installs package-owned agent skills, a lifecycle risk that warrants a warning. Inspected JavaScript does not establish malicious behavior, and the bundled binary contents were unavailable for source inspection.

Evidence

package.jsonscripts/postinstall.jsbin/nanocorp.jsbin/resolve.js

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs scripts/postinstall.js automatically after installation.

nanocorp@0.3.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code