registry / @whalent/agent-core / 0.3.509
@whalent/agent-core@0.3.509
⚠ Under reviewCore runtime for Whalent Agent
AI Security Review
scanned 9d ago · by lpm-firewall-aiStatic inspection found agent skill installation and download helpers in an obfuscated bundle, but did not establish their callers or consent boundary. Manual review is appropriate because no concrete attack or benign activation path was confirmed.
Static reason
One or more suspicious static signals were detected.
Trigger
Unresolved; the inspected source does not establish whether these helpers run automatically or only on an explicit request.
Impact
Potential agent skill configuration changes or network transfer remain unverified.
Mechanism
The helper writes downloaded skill files into agent-related directories and uses an authorization header for the download request.
AI rationale
Static inspection found agent skill installation and download helpers in an obfuscated bundle, but did not establish their callers or consent boundary. Manual review is appropriate because no concrete attack or benign activation path was confirmed.
Evidence
dist/mcp.cjs
Decision evidence
public snapshotAI called this Manual Review at 73.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest points its CLI entrypoint to bundled code and declares no lifecycle hook.
- The bundle maps skills to user, workspace, or managed agent directories and contains a helper that writes skill files there; its caller and activation were not resolved.
- A bundle helper downloads skill files from a configured base URL using an authorization header; its caller and destination configuration were not resolved.
Evidence against
- The manifest lists only ssh2 and node-pty as dependencies and contains no install lifecycle script.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
NoLicense
Source & flagged code
8 flagged · loading sourcedist/mcp.cjsView file
4|| (${_0x36178c} === "string" && ${_0x31b9b2} && ${_0x31b9b2} == +${_0x31b9b2} && !(${_0x31b9b2} % 1))`)[_0x5848fb(0x2202)](_0xf225e,(0x0,_0x2198b1['_'])`+${_0x31b9b2}`);return;cas...
L5: || ${_0x36178c} === "boolean" || ${_0x31b9b2} === null`)['assign'](_0xf225e,(0x0,_0x2198b1['_'])`[${_0x31b9b2}]`);}}}function _0x26873a({gen:_0x2afcf5,parentData:_0xb8e8c9,parentDa...
L6: missingProperty: ${_0x2d820a},
L7: depsCount: ${_0xdbb9c7},
L8: deps: ${_0x13008b}}`};var _0x138f4e={'keyword':_0x5615f6(0x1692),'type':'object','schemaType':_0x5615f6(0x1802),'error':_0x408c60['error'],'code'(_0x30dc2a){const [_0x560ad5,_0x25b...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/mcp.cjsView on unpkg · L41#!/usr/bin/env node
L2: 'use strict';var a0_0x52a1c9=a0_0x485b;(function(_0x47dad5,_0x2384a4){var _0x2321e7=a0_0x485b,_0x3e426c=_0x47dad5();while(!![]){try{var _0x27e21a=parseInt(_0x2321e7(0x213d))/0x1+pa...
L3: || (${_0x36178c} == "string" && ${_0x31b9b2} && ${_0x31b9b2} == +${_0x31b9b2})`)['assign'](_0xf225e,(0x0,_0x2198b1['_'])`+${_0x31b9b2}`);return;case _0x5848fb(0x19ff):_0x3ec4a3[_0x...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1Findings
4 High7 Medium5 Low
HighSame File Env Network Executiondist/mcp.cjs
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/index.cjs
MediumOversized Cli Entrypointdist/index.cjs
MediumStructural Risk Force Deep Review
LowEvaldist/mcp.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @whalent/agent-core@0.3.509.
See all versions of @whalent/agent-core for other recorded verdicts.
- Review the evidence and your use of @whalent/agent-core@0.3.509 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.