registry / @whalent/agent / 0.3.318

@whalent/agent@0.3.318

Stable wrapper for Whalent Agent core runtime

AI Security Review

scanned 17d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A user-run daemon connects to the Whalent platform, receives configuration/remote commands, and can install managed AI-agent extensions. It also downloads and executes versioned helper binaries after a manifest-provided SHA-256 check.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the whalent CLI/daemon.

Impact

A compromised or malicious platform/manifest could control the daemon and its managed agent extensions.

Mechanism

Remote gateway control, AI-agent configuration writes, and verified helper-binary activation.

Rationale

No concrete malicious install-time behavior was found, but obfuscated runtime code combines remote control, cross-agent configuration writes, and downloaded executable helpers. This warrants a warning rather than a block under the stated policy.

Evidence

package.jsonREADME.mddist/index.cjsdist/core.cjsdist/jupyter_sidecar.py

Network endpoints1

memory.whalent.com

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

@whalent/agent@0.3.318

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code