@whalent/agent-core@0.3.496
Core runtime for Whalent Agent
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe inspected bundle exposes agent configuration and skill-writing capabilities, but the evidence does not establish their callers or consent gates. This leaves an unresolved agent capability risk, without evidence of an active attack or install-time trigger.
Static reason
One or more suspicious static signals were detected.
Trigger
Unknown from the inspected excerpts; the manifest has no npm install lifecycle hook.
Impact
If invoked, these routines can alter agent configuration or add agent skills; the extent and consent conditions remain unresolved.
Mechanism
A routine writes an MCP server entry to Claude configuration, and another creates a skill directory and writes skill files.
AI rationale
The inspected bundle exposes agent configuration and skill-writing capabilities, but the evidence does not establish their callers or consent gates. This leaves an unresolved agent capability risk, without evidence of an active attack or install-time trigger.
Evidence
.claude.json
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes a bundled command-line entrypoint and lists dist/mcp.cjs as package content.
- The bundle reads and writes Claude configuration and can add an MCP server entry.
- The bundle also contains a skill installation routine that writes files; the available excerpts do not establish its caller or consent gate.
Evidence against
- The manifest defines no preinstall, install, or postinstall hook.
- The inspected excerpts do not establish credential collection, exfiltration, or an active attack.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
NoLicense
Source & flagged code
7 flagged · loading sourcedist/mcp.cjsView file
1#!/usr/bin/env node
L2: 'use strict';var a0_0xb6e8ce=a0_0x3d69;(function(_0x256149,_0x592ed6){var _0x2a05ab=a0_0x3d69,_0x2ab102=_0x256149();while(!![]){try{var _0x17df2a=-parseInt(_0x2a05ab(0x173a))/0x1+p...
L3: || (${_0x43a476} == "string" && ${_0x217aa} && ${_0x217aa} == +${_0x217aa})`)[_0xf15309(0x1304)](_0x5c9d9a,(0x0,_0x148120['_'])`+${_0x217aa}`);return;case _0xf15309(0x226e):_0x59f4...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/mcp.cjsView on unpkg4|| (${_0x43a476} === "string" && ${_0x217aa} && ${_0x217aa} == +${_0x217aa} && !(${_0x217aa} % 1))`)[_0xf15309(0x1304)](_0x5c9d9a,(0x0,_0x148120['_'])`+${_0x217aa}`);return;case'bo...
L5: || ${_0x43a476} === "boolean" || ${_0x217aa} === null`)[_0xf15309(0x1304)](_0x5c9d9a,(0x0,_0x148120['_'])`[${_0x217aa}]`);}}}function _0x49ba4e({gen:_0x1b1875,parentData:_0xdee631,...
L6: missingProperty: ${_0x3555d5},
Medium
Findings
3 High7 Medium5 Low
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/index.cjs
MediumOversized Cli Entrypointdist/index.cjs
MediumStructural Risk Force Deep Review
LowEvaldist/mcp.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @whalent/agent-core@0.3.496.
See all versions of @whalent/agent-core for other recorded verdicts.
- Review the evidence and your use of @whalent/agent-core@0.3.496 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.