registry / @whalent/agent / 0.3.342

@whalent/agent@0.3.342

Stable wrapper for Whalent Agent core runtime

AI Security Review

scanned 9d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. When a user runs the daemon, it contacts Whalent infrastructure, receives configuration and remote commands, and periodically downloads helper manifests. This is a remote-managed agent lifecycle with local process and helper-update capability, but not an install-time attack.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the whalent CLI/daemon with a token.

Impact

Can auto-start configured workers, apply upgrades/restarts, and replace managed helper components.

Mechanism

Remote configuration, command handling, and periodic helper-manifest activation.

Rationale

This is a declared but high-impact remote agent-extension lifecycle, not concrete install-time malware. Warn because obfuscation and periodic remote activation prevent a clean verdict.

Evidence

package.jsonREADME.mddist/index.cjsdist/jupyter_sidecar.py~/.whalent-agent/helpers/sqlite

Network endpoints1

memory.whalent.com

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

@whalent/agent@0.3.342

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code