registry / @whalent/agent-core / 0.3.458
@whalent/agent-core@0.3.458
Core runtime for Whalent Agent
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe published manifest has no install lifecycle and no self-dependency, and the readable behavior matches a user-launched agent core that talks to its own providers and a local Jupyter sidecar. Obfuscation and process, SSH, and API-key handling are package-aligned capabilities without a concrete exfiltration or control-hijack chain.
Static reason
One or more suspicious static signals were detected.
Trigger
A user or the @whalent/agent wrapper launches the whalent-core bin or MCP entry; package install does not run a lifecycle script.
Impact
No concrete credential theft, remote payload execution, persistence, or unconsented agent control-surface write was established from the inspected files.
Mechanism
The published manifest only depends on ssh2 and optional node-pty. Provider env keys and the Jupyter sidecar stay inside the agent runtime rather than an install hook or a hidden recipient.
AI rationale
The published manifest has no install lifecycle and no self-dependency, and the readable behavior matches a user-launched agent core that talks to its own providers and a local Jupyter sidecar. Obfuscation and process, SSH, and API-key handling are package-aligned capabilities without a concrete exfiltration or control-hijack chain.
Decision evidence
public snapshotAI called this Clean at 72.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- Published package.json is @whalent/agent-core 0.3.458 with main and bin dist/index.cjs and no preinstall, install, or postinstall scripts.
- Registry dependencies are only ssh2 and optional node-pty; the published manifest does not depend on its own package name.
- dist/mcp.cjs is a Node entry that freezes provider auth environment key names such as ANTHROPIC_API_KEY for the agent client.
- dist/jupyter_sidecar.py is a local stdin/stdout NDJSON Jupyter kernel helper owned by this agent runtime.
Evidence against
- dist/index.cjs and dist/mcp.cjs are javascript-obfuscator style bundles, so large parts of the runtime are not plain source.
- Readable names include child_process, writeDesktopLink under a Whalent path, ssh2, and provider API key handling consistent with a user-launched agent.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcedist/mcp.cjsView file
1#!/usr/bin/env node
L2: 'use strict';var a0_0x4654a5=a0_0x4e5a;(function(_0x795c1b,_0x5961e9){var _0x5bdb1b=a0_0x4e5a,_0x51edee=_0x795c1b();while(!![]){try{var _0x4fdaeb=-parseInt(_0x5bdb1b(0x107c))/0x1*(...
L3: || (${_0x4baff5} == "string" && ${_0x54f400} && ${_0x54f400} == +${_0x54f400})`)['assign'](_0x138ba1,(0x0,_0x38ea62['_'])`+${_0x54f400}`);return;case'integer':_0x5cb50a[_0x210e07(0...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/mcp.cjsView on unpkg4|| (${_0x4baff5} === "string" && ${_0x54f400} && ${_0x54f400} == +${_0x54f400} && !(${_0x54f400} % 1))`)[_0x210e07(0x1757)](_0x138ba1,(0x0,_0x38ea62['_'])`+${_0x54f400}`);return;ca...
L5: || ${_0x4baff5} === "boolean" || ${_0x54f400} === null`)[_0x210e07(0x1757)](_0x138ba1,(0x0,_0x38ea62['_'])`[${_0x54f400}]`);}}}function _0x553e78({gen:_0x133ab2,parentData:_0x5bdd1...
L6: missingProperty: ${_0x11c40e},
Medium
Findings
3 High7 Medium5 Low
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/index.cjs
MediumOversized Cli Entrypointdist/index.cjs
MediumStructural Risk Force Deep Review
LowEvaldist/mcp.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @whalent/agent-core@0.3.458.
See all versions of @whalent/agent-core for other recorded verdicts.
- Review the evidence and your use of @whalent/agent-core@0.3.458 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.