registry / @whalent/agent / 0.3.316

@whalent/agent@0.3.316

Stable wrapper for Whalent Agent core runtime

AI Security Review

scanned 17d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The explicit whalent CLI starts a persistent, network-connected agent that can fetch configuration, activate workers, download helper releases, and process remote upgrade/restart commands. Obfuscation prevents a fully transparent source audit.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the whalent CLI/daemon.

Impact

A trusted platform or update-channel compromise could deliver behavior or native helper code to the running agent.

Mechanism

Obfuscated supervised agent runtime with remote configuration and helper-update capability.

Rationale

The package is an obfuscated remote-management agent with runtime update and worker-launch capabilities, creating unresolved supply-chain risk. No npm lifecycle hook or concrete malicious chain was found, so blocking is not justified.

Evidence

package.jsonREADME.mddist/index.cjsdist/core.cjsdist/jupyter_sidecar.py

Network endpoints2

memory.whalent.comregistry.npmjs.org

Decision evidence

public snapshot

AI called this at 86.0% confidence with false-positive risk.

@whalent/agent@0.3.316

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code