registry / @whalent/agent / 0.3.357

@whalent/agent@0.3.357

Stable wrapper for Whalent Agent core runtime

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Runtime invocation launches an obfuscated CLI wrapper with update/core-selection behavior. Its Jupyter sidecar can execute protocol-supplied Python, but no concrete unconsented attack chain was found.

Static reason

One or more suspicious static signals were detected.

Trigger

User invokes the whalent CLI or sends an execute request to its sidecar.

Impact

Opaque runtime updates could change executable behavior; no specific exfiltration, persistence, or destructive action was confirmed.

Mechanism

obfuscated runtime wrapper and requested code execution

Rationale

The package is not proven malicious, but its obfuscated executable bundles and runtime-update path prevent a trustworthy clean determination. Warn rather than block because activation is runtime/user-driven and no concrete attack behavior was established.

Evidence

package.jsondist/index.cjsdist/core.cjsdist/jupyter_sidecar.py

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The CLI entrypoint is heavily obfuscated, preventing normal source audit.
Obfuscated runtime code includes wrapper-update and alternate core-entry logic.

@whalent/agent@0.3.357

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code