registry / @whalent/agent-core / 0.3.518
@whalent/agent-core@0.3.518
Core runtime for Whalent Agent
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package is heavily obfuscated and includes first-party agent skill installation that writes into agent directories, leaving a meaningful but unresolved lifecycle and activation risk. The inspected source does not establish an automatic install trigger or concrete attack behavior, so a warning is appropriate.
Static reason
One or more suspicious static signals were detected.
Trigger
Calling the bundled skill installation routine; whether a user action is required remains unresolved.
Impact
If invoked, it can add files to an agent skill directory; the inspected excerpts do not show harmful payload behavior.
Mechanism
The routine selects a skill directory and creates it before writing supplied files.
AI rationale
The package is heavily obfuscated and includes first-party agent skill installation that writes into agent directories, leaving a meaningful but unresolved lifecycle and activation risk. The inspected source does not establish an automatic install trigger or concrete attack behavior, so a warning is appropriate.
Evidence
dist/mcp.cjs
Decision evidence
public snapshotAI called this Suspicious at 73.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes bundled files as the package entrypoint and CLI, with no lifecycle scripts listed.
- The bundled code selects skill directories under agent-specific home or workspace paths.
- A skill installation routine creates directories and writes supplied files into the selected skill directory.
- The bundle uses generated functions in bundled code, and its heavily obfuscated structure limits confirmation of activation paths.
Evidence against
- The inspected excerpts do not establish automatic installation-time agent configuration changes, credential transfer, or a malicious network action.
- The skill-writing code is a callable installation routine; the inspected source does not establish that it runs without a user action.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinified
Source & flagged code
7 flagged · loading sourcedist/mcp.cjsView file
1#!/usr/bin/env node
L2: 'use strict';var a0_0x4c7b15=a0_0x4a2d;(function(_0xd43697,_0x4ddad0){var _0x462579=a0_0x4a2d,_0x2c2a19=_0xd43697();while(!![]){try{var _0x25470d=-parseInt(_0x462579(0xa81))/0x1+-p...
L3: || (${_0x5e8c5b} == "string" && ${_0x372573} && ${_0x372573} == +${_0x372573})`)[_0x12984c(0x96)](_0x1fa142,(0x0,_0x39d391['_'])`+${_0x372573}`);return;case _0x12984c(0x132):_0x11a...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/mcp.cjsView on unpkg4|| (${_0x5e8c5b} === "string" && ${_0x372573} && ${_0x372573} == +${_0x372573} && !(${_0x372573} % 1))`)['assign'](_0x1fa142,(0x0,_0x39d391['_'])`+${_0x372573}`);return;case'boolea...
L5: || ${_0x5e8c5b} === "boolean" || ${_0x372573} === null`)[_0x12984c(0x96)](_0x1fa142,(0x0,_0x39d391['_'])`[${_0x372573}]`);}}}function _0x579a6b({gen:_0x1fb7f,parentData:_0x165b05,p...
L6: missingProperty: ${_0x55ab78},
Medium
Findings
3 High7 Medium5 Low
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/index.cjs
MediumOversized Cli Entrypointdist/index.cjs
MediumStructural Risk Force Deep Review
LowEvaldist/mcp.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @whalent/agent-core@0.3.518.
See all versions of @whalent/agent-core for other recorded verdicts.
- Review the evidence and your use of @whalent/agent-core@0.3.518 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.