registry / @whalent/agent / 0.3.425
@whalent/agent@0.3.425
Stable wrapper for Whalent Agent core runtime
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe absence of install hooks rules out an automatic install-chain block. Deliberate obfuscation around CLI update and process-control behavior leaves a real unresolved runtime risk.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the whalent command.
Impact
It can change or restart the package runtime after explicit CLI use; no install-time attack was confirmed.
Mechanism
Obfuscated CLI wrapper with update and process-management routines.
AI rationale
The absence of install hooks rules out an automatic install-chain block. Deliberate obfuscation around CLI update and process-control behavior leaves a real unresolved runtime risk.
Evidence
dist/index.cjs
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The executable entry point is deliberately obfuscated, preventing normal audit of its runtime behavior.
- When the user runs the CLI, its main routine invokes a wrapper-update routine before supervising the core process.
- The CLI contains routines to run npm commands and check persistence context, creating an opaque update and process-management capability.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare hook; its only lifecycle script is prepublishOnly.
- The risky wrapper logic is reached through the user-invoked whalent CLI, not package installation.
- No concrete credential theft, destructive action, or network endpoint was recoverable from the inspected source.
Behavioral surface
DynamicRequireEnvironmentVarsFilesystem
MinifiedPossibleObfuscationTrivial
NoLicense
Source & flagged code
6 flagged · loading sourcedist/index.cjsView file
1#!/usr/bin/env node
L2: 'use strict';(function(_0x57c2da,_0xdc43a4){function _0x528b6a(_0x3e4ea9,_0x6f6688,_0x52777a,_0x27e728){return a0_0x4e8e(_0x27e728-0x328,_0x6f6688);}function _0x2e84a5(_0x3a17f2,_0...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/index.cjsView on unpkg · L11#!/usr/bin/env node
L2: 'use strict';(function(_0x57c2da,_0xdc43a4){function _0x528b6a(_0x3e4ea9,_0x6f6688,_0x52777a,_0x27e728){return a0_0x4e8e(_0x27e728-0x328,_0x6f6688);}function _0x2e84a5(_0x3a17f2,_0...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.cjsView on unpkg · L12'use strict';(function(_0x57c2da,_0xdc43a4){function _0x528b6a
Medium
Ai Review Evidence
The executable entry point is deliberately obfuscated, preventing normal audit of its runtime behavior.
dist/index.cjsView on unpkg · L2Findings
1 High7 Medium4 Low
HighObfuscated Payload Loaderdist/index.cjs
MediumDynamic Requiredist/index.cjs
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/core.cjs
MediumOversized Cli Entrypointdist/core.cjs
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/index.cjs
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowNo License
Affected versions and remediation
This report applies to @whalent/agent@0.3.425.
See all versions of @whalent/agent for other recorded verdicts.
- Review the evidence and your use of @whalent/agent@0.3.425 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.