registry / @whalent/agent / 0.3.319

@whalent/agent@0.3.319

Stable wrapper for Whalent Agent core runtime

AI Security Review

scanned 17d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the whalent CLI, particularly daemon mode with a token.

Impact

A configured remote platform can direct the running agent and cause package/helper updates; this is a dangerous remote-management capability.

Mechanism

Obfuscated remote agent daemon with runtime npm self-update and downloaded helpers.

Rationale

This is not concrete npm-install malware, but it ships an obfuscated, remotely controlled AI-agent daemon with runtime update and helper-download capability. That warrants a warning rather than a publish block.

Evidence

package.jsondist/index.cjsdist/core.cjsREADME.mddist/jupyter_sidecar.py

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

dist/index.cjs is deliberately obfuscated, limiting auditability.

@whalent/agent@0.3.319

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code