Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@whalent/agent@0.3.315: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 13 finding(s) warrant review before installing.

View on npm All versions

registry / @whalent/agent / 0.3.315

@whalent/agent@0.3.315

Stable wrapper for Whalent Agent core runtime

AI Security Review

scanned 17d ago · by lpm-firewall-ai

A token-authenticated daemon can receive gateway configuration and remote lifecycle commands. It also fetches and activates helper releases at runtime.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `whalent --token ...` / starts the daemon.

Impact

A compromised or malicious configured gateway/release source could cause code or helper execution on the host.

Mechanism

Remote-managed worker execution and runtime helper updates.

Rationale

The package has no install hook and its risky behavior is user-invoked, so blocking is not justified. Obfuscation plus runtime remote control and helper activation warrant a warning.

Evidence

package.jsonREADME.mddist/index.cjsdist/core.cjs~/.whalent-agent/helpers/sqlite

Network endpoints2

memory.whalent.comwss://your-server/gw/sdk/ws

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

Evidence for warning

dist/index.cjs is deliberately obfuscated and supervises core updates.
README.md documents automatic helper download and activation from a release API.
README.md documents gateway-delivered configuration, auto-started workers, and remote upgrade/restart commands.
dist/core.cjs contains remote-access WebSocket and child-process handling.

Evidence against

package.json has no preinstall, install, postinstall, or prepare hook.
Activation requires the user to run the whalent CLI with a token.
No concrete credential-harvesting or unrelated exfiltration path was confirmed.

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsMinifiedObfuscatedTrivial

Manifest

NoLicense

scanned 1 file(s), 414 KB of source

Oversized source lightweight scan

dist/core.cjs13.7 MB file, sampled 256 KB

EnvironmentVarsDynamicRequireObfuscatedHighEntropyStringsMinified

Source & flagged code

5 flagged · loading source

dist/index.cjsView file

1#!/usr/bin/env node L2: 'use strict';(function(_0x5b9268,_0x5b9aa4){const _0x47c2a6=_0x5b9268();function _0x10a930(_0x53fad9,_0x87eaf9,_0x2ad07e,_0x3f80dc){return a0_0x460e(_0x53fad9- -0xfe,_0x87eaf9);}fu...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.cjsView on unpkg · L1

1#!/usr/bin/env node L2: 'use strict';(function(_0x5b9268,_0x5b9aa4){const _0x47c2a6=_0x5b9268();function _0x10a930(_0x53fad9,_0x87eaf9,_0x2ad07e,_0x3f80dc){return a0_0x460e(_0x53fad9- -0xfe,_0x87eaf9);}fu...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L1

dist/jupyter_sidecar.pyView file

•path = dist/jupyter_sidecar.py kind = build_helper sizeBytes = 18590 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/jupyter_sidecar.pyView on unpkg

dist/core.cjsView file

•path = dist/core.cjs kind = oversized_source_file sizeBytes = 14345007 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/core.cjsView on unpkg

•path = dist/core.cjs kind = oversized_cli_entrypoint sizeBytes = 14345007 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/core.cjsView on unpkg

Findings

2 High6 Medium5 Low

HighObfuscated Payload Loaderdist/index.cjs

HighObfuscated

MediumDynamic Requiredist/index.cjs

MediumEnvironment Vars

MediumShips Build Helperdist/jupyter_sidecar.py

MediumOversized Source Filedist/core.cjs

MediumOversized Cli Entrypointdist/core.cjs

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

88%Warn

Verdict confidence

IntentUnknown

TypeRemote Code Execution

False-positive riskMedium

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

Maintainerswhalent

Version0.3.365

PublishedAug 8, 2026

LicenseUNLICENSED

Dependencies12

Integrityverified

Package size5.26 MB

Files5

Keywordswhalentagentcodexclaudekimiacpai

Runtime surface

package.json

Entrypointsmain → dist/index.cjsbin → whalent

Runtimenode >=20.0.0

Artifact13.9 MB · 5 files1 signature(s)

Install lifecycleprepublishOnly

Behavioral surface

DynamicRequireEnvironmentVarsFilesystemHighEntropyStringsMinifiedObfuscatedTrivialNoLicense

LPM CLI

Source & flagged code

5 flagged

dist/index.cjsView file

Lines 1-2javascript

1#!/usr/bin/env node

2'use strict';(function(_0x5b9268,_0x5b9aa4){const _0x47c2a6=_0x5b9268();function _0x10a930(_0x53fad9,_0x87eaf9,_0x2ad07e,_0x3f80dc){return a0_0x460e(_0x53fad9- -0xfe,_0x87eaf9);}function _0x5dbef4(_0x29c81f,_0xe464b1,_0x1d1e9f,_0x20ecf8){return a0_0x460e(_0xe464b1- -0x25,_0x29c81f);}while(!![]){try{const _0x1c6922=-parseInt(_0x5dbef4('%yuv',0x6e8,0x6de,0x69a))/(-0x1d76+-0x33d*0x7+0x3422)+-parseInt(_0x10a930(0x616,'$t(%',0x547,0x4e2))/(-0x1a8*-0x2+-0x3f5*-0x8+-0x22f6)+parseInt(_0x5dbef4('INM4',0x277,0x182,0x2bc))/(0x4*0x524+0x16+-0x14a3)*(-parseInt(_0x5dbef4('qTjS',0x489,0x302,0x51f))/(-0xa2a+0 ...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.cjsView on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L1

Long lines were clipped for display.

dist/jupyter_sidecar.pyView file

•path = dist/jupyter_sidecar.py kind = build_helper sizeBytes = 18590 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/jupyter_sidecar.pyView on unpkg

dist/core.cjsView file

•path = dist/core.cjs kind = oversized_source_file sizeBytes = 14345007 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/core.cjsView on unpkg

•path = dist/core.cjs kind = oversized_cli_entrypoint sizeBytes = 14345007 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/core.cjsView on unpkg