registry / @whalent/agent / 0.3.320

@whalent/agent@0.3.320

Stable wrapper for Whalent Agent core runtime

AI Security Review

scanned 17d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The obfuscated CLI performs persistence prompting and runtime update/supervision. No install-time execution or confirmed unconsented control-surface mutation was established.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the whalent CLI.

Impact

Runtime-controlled updates and persistence behavior warrant caution, but no concrete malicious chain was proven.

Mechanism

Obfuscated runtime self-update and helper-release activation

Rationale

The package is highly obfuscated and has runtime update/persistence capabilities, creating unresolved lifecycle risk. It does not meet the blocking threshold because no install-time mutation or concrete malicious behavior was confirmed.

Evidence

package.jsonREADME.mddist/index.cjsdist/jupyter_sidecar.pydist/core.cjs

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/index.cjs is deliberately obfuscated.
CLI runtime calls ensurePersistencePrompt before launching core.

@whalent/agent@0.3.320

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code