@whalent/agent-core@0.3.485
Core runtime for Whalent Agent
AI Security Review
scanned 21d ago · by lpm-firewall-aiSource confirms explicit agent configuration mutation, which warrants a warning under the supplied policy. No block-eligible attack was established, and obfuscation alone does not prove malware.
Static reason
One or more suspicious static signals were detected.
Trigger
Calling the MCP registration operation with a server command and selected agent configuration.
Impact
Registered servers can influence subsequent agent sessions and execute their configured commands when launched by the agent.
Mechanism
Caller-provided command, arguments, and environment are inserted into agent configuration and persisted to disk.
AI rationale
Source confirms explicit agent configuration mutation, which warrants a warning under the supplied policy. No block-eligible attack was established, and obfuscation alone does not prove malware.
Evidence
dist/mcp.cjsconfig.tomlopencode.json
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The MCP registration operation accepts a command, arguments, and environment, then injects that server into the selected agent configuration.
- The OpenCode configuration writer persists modified configuration to disk.
- The Codex server injector accesses config.toml in the supplied configuration directory.
- The manifest declares ssh2 and optional node-pty dependencies, with no lifecycle hooks or runtime self-dependency.
Evidence against
- Configuration mutation is activated by an explicit MCP tool operation rather than npm installation.
- No concrete credential theft, covert payload execution, or malicious install chain was established.
- Heavy obfuscation limits confidence in the remaining entrypoint behavior; the inspected Function constructor is schema-validation code.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStrings
Source & flagged code
8 flagged · loading sourcedist/mcp.cjsView file
4|| (${_0x20796d} === "string" && ${_0x2b4f10} && ${_0x2b4f10} == +${_0x2b4f10} && !(${_0x2b4f10} % 1))`)[_0x5a3125(0x945)](_0x18a294,(0x0,_0x5adcf3['_'])`+${_0x2b4f10}`);return;cas...
L5: || ${_0x20796d} === "boolean" || ${_0x2b4f10} === null`)['assign'](_0x18a294,(0x0,_0x5adcf3['_'])`[${_0x2b4f10}]`);}}}function _0x1cbea2({gen:_0x166c66,parentData:_0x2ef34e,parentD...
L6: missingProperty: ${_0x3045b6},
L7: depsCount: ${_0x71b792},
L8: deps: ${_0xe73b48}}`};var _0x5a277d={'keyword':_0x1149fe(0x20fc),'type':_0x1149fe(0xdd3),'schemaType':'object','error':_0x105867[_0x1149fe(0x755)],'code'(_0x2cade0){const [_0x569d5...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/mcp.cjsView on unpkg · L41#!/usr/bin/env node
L2: 'use strict';var a0_0x59bd72=a0_0x2066;(function(_0x49bab7,_0x34d2e6){var _0x4afcf0=a0_0x2066,_0x51e9e9=_0x49bab7();while(!![]){try{var _0x36aed1=-parseInt(_0x4afcf0(0x1759))/0x1+p...
L3: || (${_0x20796d} == "string" && ${_0x2b4f10} && ${_0x2b4f10} == +${_0x2b4f10})`)['assign'](_0x18a294,(0x0,_0x5adcf3['_'])`+${_0x2b4f10}`);return;case _0x5a3125(0xa3d):_0x3e31de['el...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1Findings
4 High7 Medium5 Low
HighSame File Env Network Executiondist/mcp.cjs
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/index.cjs
MediumOversized Cli Entrypointdist/index.cjs
MediumStructural Risk Force Deep Review
LowEvaldist/mcp.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @whalent/agent-core@0.3.485.
See all versions of @whalent/agent-core for other recorded verdicts.
- Review the evidence and your use of @whalent/agent-core@0.3.485 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.