Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@whalent/agent@0.3.321: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 13 finding(s) warrant review before installing.

View on npm All versions

registry / @whalent/agent / 0.3.321

@whalent/agent@0.3.321

Stable wrapper for Whalent Agent core runtime

AI Security Review

scanned 16d ago · by lpm-firewall-ai

The user-invoked CLI starts a persistent agent daemon, manages local state, and supports upgrading/restarting workers. Obfuscation prevents independently validating its remote control and helper-update paths.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the whalent CLI/daemon.

Impact

A compromised or malicious control plane could run or update local agent components.

Mechanism

Remote-managed agent execution with local upgrade and process-control capabilities.

Rationale

This is a dangerous remote-managed agent capability with opaque implementation, but source inspection found no concrete malicious install-time or covert exfiltration chain.

Evidence

package.jsondist/index.cjsdist/core.cjsdist/jupyter_sidecar.pyREADME.md~/.whalent-agent

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/index.cjs is deliberately obfuscated.
CLI writes persistent state under ~/.whalent-agent.

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

CLI includes self-upgrade and process-spawn helpers.

README describes daemon auto-start workers and remote upgrade/restart commands.

Evidence against

package.json has no preinstall/install/postinstall hook.
No concrete credential harvesting or exfiltration found.
dist/jupyter_sidecar.py is a bounded Jupyter RPC sidecar.
dist/core.cjs new Function is in PAC proxy resolution code.

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsMinifiedObfuscatedTrivial

Manifest

NoLicense

scanned 1 file(s), 414 KB of source

Oversized source lightweight scan

dist/core.cjs13.7 MB file, sampled 256 KB

EnvironmentVarsDynamicRequireObfuscatedHighEntropyStringsMinified

Source & flagged code

5 flagged · loading source

dist/index.cjsView file

1#!/usr/bin/env node L2: 'use strict';(function(_0x5b9268,_0x5b9aa4){const _0x47c2a6=_0x5b9268();function _0x10a930(_0x53fad9,_0x87eaf9,_0x2ad07e,_0x3f80dc){return a0_0x460e(_0x53fad9- -0xfe,_0x87eaf9);}fu...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.cjsView on unpkg · L1

1#!/usr/bin/env node L2: 'use strict';(function(_0x5b9268,_0x5b9aa4){const _0x47c2a6=_0x5b9268();function _0x10a930(_0x53fad9,_0x87eaf9,_0x2ad07e,_0x3f80dc){return a0_0x460e(_0x53fad9- -0xfe,_0x87eaf9);}fu...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L1

dist/jupyter_sidecar.pyView file

•path = dist/jupyter_sidecar.py kind = build_helper sizeBytes = 18590 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/jupyter_sidecar.pyView on unpkg

dist/core.cjsView file

•path = dist/core.cjs kind = oversized_source_file sizeBytes = 14341680 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/core.cjsView on unpkg

•path = dist/core.cjs kind = oversized_cli_entrypoint sizeBytes = 14341680 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/core.cjsView on unpkg

Findings

2 High6 Medium5 Low

HighObfuscated Payload Loaderdist/index.cjs

HighObfuscated

MediumDynamic Requiredist/index.cjs

MediumEnvironment Vars

MediumShips Build Helperdist/jupyter_sidecar.py

MediumOversized Source Filedist/core.cjs

MediumOversized Cli Entrypointdist/core.cjs

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

83%Warn

Verdict confidence

IntentDangerous Capability

TypeRemote Code Execution

False-positive riskMedium

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

Maintainerswhalent

Version0.3.365

PublishedAug 9, 2026

LicenseUNLICENSED

Dependencies12

Integrityverified

Package size5.26 MB

Files5

Keywordswhalentagentcodexclaudekimiacpai

Runtime surface

package.json

Entrypointsmain → dist/index.cjsbin → whalent

Runtimenode >=20.0.0

Artifact13.9 MB · 5 files1 signature(s)

Install lifecycleprepublishOnly

Behavioral surface

DynamicRequireEnvironmentVarsFilesystemHighEntropyStringsMinifiedObfuscatedTrivialNoLicense

LPM CLI

Source & flagged code

5 flagged

dist/index.cjsView file

Lines 1-2javascript

1#!/usr/bin/env node

2'use strict';(function(_0x5b9268,_0x5b9aa4){const _0x47c2a6=_0x5b9268();function _0x10a930(_0x53fad9,_0x87eaf9,_0x2ad07e,_0x3f80dc){return a0_0x460e(_0x53fad9- -0xfe,_0x87eaf9);}function _0x5dbef4(_0x29c81f,_0xe464b1,_0x1d1e9f,_0x20ecf8){return a0_0x460e(_0xe464b1- -0x25,_0x29c81f);}while(!![]){try{const _0x1c6922=-parseInt(_0x5dbef4('%yuv',0x6e8,0x6de,0x69a))/(-0x1d76+-0x33d*0x7+0x3422)+-parseInt(_0x10a930(0x616,'$t(%',0x547,0x4e2))/(-0x1a8*-0x2+-0x3f5*-0x8+-0x22f6)+parseInt(_0x5dbef4('INM4',0x277,0x182,0x2bc))/(0x4*0x524+0x16+-0x14a3)*(-parseInt(_0x5dbef4('qTjS',0x489,0x302,0x51f))/(-0xa2a+0 ...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.cjsView on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L1

Long lines were clipped for display.

dist/jupyter_sidecar.pyView file

•path = dist/jupyter_sidecar.py kind = build_helper sizeBytes = 18590 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/jupyter_sidecar.pyView on unpkg

dist/core.cjsView file

•path = dist/core.cjs kind = oversized_source_file sizeBytes = 14341680 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/core.cjsView on unpkg

•path = dist/core.cjs kind = oversized_cli_entrypoint sizeBytes = 14341680 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/core.cjsView on unpkg