registry / @whalent/agent / 0.3.324

@whalent/agent@0.3.324

Stable wrapper for Whalent Agent core runtime

AI Security Review

scanned 15d ago · by lpm-firewall-ai

No confirmed malicious install-time or covert attack surface. The user-invoked CLI runs an obfuscated agent runtime that can connect to its configured service and process agent data.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the whalent CLI with a token or gateway configuration.

Impact

The runtime has broad agent capabilities, but inspected behavior is package-aligned and not activated during npm installation.

Mechanism

User-authorized agent daemon, local history integration, and supervised core execution.

Rationale

The package is heavily obfuscated and operationally powerful, but source inspection found no install hook, covert loader, or concrete exfiltration/mutation chain. Its process spawning, remote gateway, and Codex-history features are user-invoked and consistent with the documented agent runtime.

Evidence

package.jsonREADME.mddist/index.cjsdist/core.cjsdist/jupyter_sidecar.py

Decision evidence

public snapshot

AI called this Clean at 82.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/index.cjs and dist/core.cjs are deliberately obfuscated.

@whalent/agent@0.3.324

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code