registry / @whalent/agent / 0.3.295

@whalent/agent@0.3.295

Stable wrapper for Whalent Agent core runtime

AI Security Review

scanned 10d ago · by lpm-firewall-ai

After explicit CLI startup, the package runs a persistent remote-managed agent that fetches configuration, starts workers, and can receive remote commands. Its deliberately obfuscated executable bundle makes the full command and update path non-auditable.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the whalent CLI/daemon after installation.

Impact

A configured gateway can control local agent workers and update helper components.

Mechanism

remote-managed worker execution and helper update activation

Rationale

No malicious install-time behavior or confirmed exfiltration was found. The opaque remote-control and update capability remains a material unresolved risk.

Evidence

package.jsonscripts/preinstall-check.cjsdist/index.cjsdist/core.cjsREADME.mddist/jupyter_sidecar.py

Network endpoints1

memory.whalent.com

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-10721

Source

OpenSSF Malicious Packages via OSV

The package installs a `whalent` CLI daemon that opens a persistent WebSocket connection (`wss://`) to a Whalent Memory gateway and, per its own README, accepts remote commands including 'upgrade' and 'restart' from that gateway. `dist/index.cjs` contains an `npmInstallCommand` builder that assembles `npm install -g @whalent/agent@<version> --registry=<DEFAULT_NPM_REGISTRY|CHINA_NPM_REGISTRY>` strings driven by the gateway's chosen version — meaning whoever controls (or compromises) the gateway can cause the daemon's host to install and execute an arbitrary version of the package as the user running the daemon. The core bundle additionally references `process.env.SHELL` and localhost RDP/VNC ports (127.0.0.1:3389, 5900, 5901), and the dependency set includes `@xterm/headless`, `node-pty` (optional), `ssh2`, and `ws`, indicating terminal/PTY and remote-session capability reachable from the same gateway channel. Both `dist/index.cjs` (main/bin entry) and the 13 MB `dist/core.cjs` are transformed with javascript-obfuscator (string-array rotator, `_0x`-named helpers, control-flow flattening), and `javascript-obfuscator` is listed in devDependencies — the obfuscation covers the gateway command dispatcher and shell sinks. The daemon fires only when the operator explicitly runs `whalent --token …`, not on `npm install` or on `require()`, but once running it provides a network-reachable code-execution and shell surface on the host controlled by the gateway operator.

@whalent/agent@0.3.295

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code