registry / @whalent/agent / 0.3.336

@whalent/agent@0.3.336

Stable wrapper for Whalent Agent core runtime

AI Security Review

scanned 11d ago · by lpm-firewall-ai

When a user runs the whalent CLI, its obfuscated wrapper checks for a newer version and can invoke global npm installation with lifecycle scripts enabled. This is a runtime remote-update path, not an install-time attack.

Static reason

One or more suspicious static signals were detected.

Trigger

User invokes the whalent CLI.

Impact

A future registry package version can be fetched and executed outside the originally installed package version.

Mechanism

Obfuscated self-updating wrapper that installs and relaunches a newer global package.

Rationale

The source establishes an opaque staged runtime-update capability with global package mutation, which warrants a warning. It does not establish concrete malicious behavior or an unconsented install-time control-surface attack.

Evidence

package.jsondist/index.cjsdist/core.cjsdist/jupyter_sidecar.py

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The CLI entrypoint is deliberately obfuscated.
On CLI execution it globally installs a newer wrapper version with lifecycle scripts enabled.

@whalent/agent@0.3.336

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code