registry / @whalent/agent-core / 0.3.456
@whalent/agent-core@0.3.456
Core runtime for Whalent Agent
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package does not show a concrete malicious lifecycle chain or confirmed exfiltration. Its opaque executable code combined with remotely supplied MCP capabilities leaves a material unresolved agent-control risk.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the CLI or MCP server with platform configuration and a token.
Impact
Remote platform-defined agent capabilities cannot be fully assessed from the deliberately obfuscated bundles; no confirmed theft or destructive effect was established.
Mechanism
The obfuscated MCP bundle requests a remote manifest and dispatches manifest tool calls over authenticated HTTP.
AI rationale
The package does not show a concrete malicious lifecycle chain or confirmed exfiltration. Its opaque executable code combined with remotely supplied MCP capabilities leaves a material unresolved agent-control risk.
Evidence
dist/index.cjsdist/mcp.cjs
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The manifest exposes a CLI entrypoint and has no npm lifecycle scripts.
- Both executable bundles are deliberately obfuscated, preventing reliable static verification of their full behavior.
- The MCP executable fetches a remote tool manifest using a bearer token and invokes remote tools through the configured platform URL.
Evidence against
- No preinstall, install, or postinstall hook is declared.
- No concrete secret-harvesting, destructive action, or unsolicited network destination was established from the inspected paths.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
NoLicense
Source & flagged code
7 flagged · loading sourcedist/mcp.cjsView file
1#!/usr/bin/env node
L2: 'use strict';var a0_0x5f0f98=a0_0x2b87;(function(_0x432a5f,_0x2529f7){var _0x4c575f=a0_0x2b87,_0x424ea3=_0x432a5f();while(!![]){try{var _0xfa49ba=-parseInt(_0x4c575f(0x39c))/0x1*(p...
L3: || (${_0x44c098} == "string" && ${_0x186d51} && ${_0x186d51} == +${_0x186d51})`)['assign'](_0x59a5f3,(0x0,_0x18280d['_'])`+${_0x186d51}`);return;case _0xb043f7(0x1dfe):_0x46aa16['e...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/mcp.cjsView on unpkg4|| (${_0x44c098} === "string" && ${_0x186d51} && ${_0x186d51} == +${_0x186d51} && !(${_0x186d51} % 1))`)['assign'](_0x59a5f3,(0x0,_0x18280d['_'])`+${_0x186d51}`);return;case _0xb04...
L5: || ${_0x44c098} === "boolean" || ${_0x186d51} === null`)[_0xb043f7(0x510)](_0x59a5f3,(0x0,_0x18280d['_'])`[${_0x186d51}]`);}}}function _0x471e7b({gen:_0x4e87d6,parentData:_0xdd5ee1...
L6: missingProperty: ${_0x5bd87b},
Medium
Findings
3 High7 Medium5 Low
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/index.cjs
MediumOversized Cli Entrypointdist/index.cjs
MediumStructural Risk Force Deep Review
LowEvaldist/mcp.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @whalent/agent-core@0.3.456.
See all versions of @whalent/agent-core for other recorded verdicts.
- Review the evidence and your use of @whalent/agent-core@0.3.456 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.