registry / @whalent/agent-core / 0.3.504
@whalent/agent-core@0.3.504
⚠ Under reviewCore runtime for Whalent Agent
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe package has no install hook, but its manifest selects a very large obfuscated entrypoint whose runtime behavior I could not resolve through static inspection. The visible skill-install helpers leave their callers and consent boundary unclear, so review is needed to resolve reachability and behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Unknown; no caller of the skill-install helper was found in the inspected source search.
Impact
An agent skill directory could be modified if the helper is reachable; unconsented modification was not confirmed.
Mechanism
The helper fetches skill files from a configured platform and writes them under a resolved agent skill directory, with checks against paths escaping that directory.
AI rationale
The package has no install hook, but its manifest selects a very large obfuscated entrypoint whose runtime behavior I could not resolve through static inspection. The visible skill-install helpers leave their callers and consent boundary unclear, so review is needed to resolve reachability and behavior.
Evidence
dist/mcp.cjs
Decision evidence
public snapshotAI called this Manual Review at 64.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json points to dist/index.cjs and declares no install lifecycle hook.
- dist/mcp.cjs contains helpers that resolve agent skill directories, fetch skill files using a bearer token, and write the files there; their activation and consent boundary remain unresolved.
- The skill file writer rejects absolute paths and paths that resolve outside the selected skill directory.
Evidence against
- The manifest lists only ssh2 and node-pty as runtime dependencies and has no lifecycle scripts.
- The inspected MCP server dispatches tools through a handler, but no caller of the skill-install helper was found in the source search.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
8 flagged · loading sourcedist/mcp.cjsView file
4|| (${_0x576f7b} === "string" && ${_0x3131b3} && ${_0x3131b3} == +${_0x3131b3} && !(${_0x3131b3} % 1))`)['assign'](_0x2dd874,(0x0,_0xd4d26c['_'])`+${_0x3131b3}`);return;case'boolea...
L5: || ${_0x576f7b} === "boolean" || ${_0x3131b3} === null`)['assign'](_0x2dd874,(0x0,_0xd4d26c['_'])`[${_0x3131b3}]`);}}}function _0x375294({gen:_0xb2d4f2,parentData:_0x56851c,parentD...
L6: missingProperty: ${_0x1b4746},
L7: depsCount: ${_0x29af7a},
L8: deps: ${_0x3d12c1}}`};var _0x17cfd5={'keyword':'dependencies','type':'object','schemaType':'object','error':_0x141e19['error'],'code'(_0x4e11be){const [_0xe817e,_0x4fb7b5]=_0x41e1b...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/mcp.cjsView on unpkg · L41#!/usr/bin/env node
L2: 'use strict';var a0_0x129b5c=a0_0xb8b7;(function(_0x5ee2d3,_0xb3031){var _0x4f6ae0=a0_0xb8b7,_0x100a97=_0x5ee2d3();while(!![]){try{var _0x40185e=parseInt(_0x4f6ae0(0x192d))/0x1*(-p...
L3: || (${_0x576f7b} == "string" && ${_0x3131b3} && ${_0x3131b3} == +${_0x3131b3})`)['assign'](_0x2dd874,(0x0,_0xd4d26c['_'])`+${_0x3131b3}`);return;case _0x4b3d27(0x1956):_0x5e821e[_0...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1Findings
4 High7 Medium5 Low
HighSame File Env Network Executiondist/mcp.cjs
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/index.cjs
MediumOversized Cli Entrypointdist/index.cjs
MediumStructural Risk Force Deep Review
LowEvaldist/mcp.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @whalent/agent-core@0.3.504.
See all versions of @whalent/agent-core for other recorded verdicts.
- Review the evidence and your use of @whalent/agent-core@0.3.504 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.