registry / @whalent/agent / 0.3.232

@whalent/agent@0.3.232

Stable wrapper for Whalent Agent core runtime

AI Security Review

scanned 10d ago · by lpm-firewall-ai

The user-invoked daemon can copy Codex credentials, install managed skills into Codex runtime homes, and establish platform-directed remote-access tunnels. No concrete malicious install-time chain was found.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Running the whalent CLI/daemon with a token

Impact

A compromised or abusive platform control plane could alter agent runtime skills, access copied credentials, or proxy approved local services.

Mechanism

platform-managed AI-agent configuration and remote-access relay

Rationale

This is not proven malware: no install-time mutation, stealth payload, or concrete credential exfiltration was established. Its obfuscated, platform-controlled credential and remote-access capabilities warrant a warning.

Evidence

package.jsonscripts/preinstall-check.cjsREADME.mddist/index.cjsdist/core.cjs$CODEX_HOME/auth.json$CODEX_HOME/config.toml~/.whalent-agent/agents/<agentId>/codex$CODEX_HOME/skills

Network endpoints1

memory.whalent.com

OSV Corroboration

The package installs a `whalent` CLI daemon that opens a persistent WebSocket connection (`wss://`) to a Whalent Memory gateway and, per its own README, accepts remote commands including 'upgrade' and 'restart' from that gateway. `dist/index.cjs` contains an `npmInstallCommand` builder that assembles `npm install -g @whalent/agent@<version> --registry=<DEFAULT_NPM_REGISTRY|CHINA_NPM_REGISTRY>` strings driven by the gateway's chosen version — meaning whoever controls (or compromises) the gateway can cause the daemon's host to install and execute an arbitrary version of the package as the user running the daemon. The core bundle additionally references `process.env.SHELL` and localhost RDP/VNC ports (127.0.0.1:3389, 5900, 5901), and the dependency set includes `@xterm/headless`, `node-pty` (optional), `ssh2`, and `ws`, indicating terminal/PTY and remote-session capability reachable from the same gateway channel. Both `dist/index.cjs` (main/bin entry) and the 13 MB `dist/core.cjs` are transformed with javascript-obfuscator (string-array rotator, `_0x`-named helpers, control-flow flattening), and `javascript-obfuscator` is listed in devDependencies — the obfuscation covers the gateway command dispatcher and shell sinks. The daemon fires only when the operator explicitly runs `whalent --token …`, not on `npm install` or on `require()`, but once running it provides a network-reachable code-execution and shell surface on the host controlled by the gateway operator.

@whalent/agent@0.3.232

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code