registry / @whalent/agent / 0.3.325

@whalent/agent@0.3.325

Stable wrapper for Whalent Agent core runtime

AI Security Review

scanned 15d ago · by lpm-firewall-ai

A user-invoked CLI starts a persistent remote-managed agent daemon. It can fetch configuration, auto-start workers, accept upgrade/restart commands, and activate downloaded helper manifests; extensive obfuscation prevents reliable source-level validation of those paths.

Static reason

One or more suspicious static signals were detected.

Trigger

Running the whalent CLI with a token or gateway configuration.

Impact

A compromised or malicious gateway/release path could control local agent-worker execution and helper activation.

Mechanism

Obfuscated remote agent daemon with runtime helper updates.

Rationale

No install-time malware or confirmed exfiltration was found, but the obfuscated remote-control/update capability is a material unresolved risk. Warn rather than block because activation requires explicit CLI use and no unconsented lifecycle mutation is present.

Evidence

package.jsonREADME.mddist/index.cjsdist/core.cjsdist/jupyter_sidecar.py

Network endpoints2

memory.whalent.comwss://your-server/gw/sdk/ws

Decision evidence

public snapshot

AI called this at 86.0% confidence with false-positive risk.

@whalent/agent@0.3.325

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code