@whalent/agent@0.3.457
Stable wrapper for Whalent Agent core runtime
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package is an obfuscated Whalent CLI with no install hook and no self-install chain, but its shipped bundle still selects agent config directories and calls the vendor host. That dual-use runtime is user-invoked and not a proven covert attack, so it warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
User execution of the whalent bin or import of the published bundle, not npm install.
Impact
Agent-directory and vendor-network behavior stays behind an explicit run. Install does not rewrite a foreign agent control surface, but obfuscation leaves write and credential sinks incompletely traced.
Mechanism
Obfuscated runtime code selects .claude or .agents under the user home and issues a GET whose host is compared with memory.whalent.com.
AI rationale
The package is an obfuscated Whalent CLI with no install hook and no self-install chain, but its shipped bundle still selects agent config directories and calls the vendor host. That dual-use runtime is user-invoked and not a proven covert attack, so it warrants a warning rather than a block.
Evidence
package.jsondist/mcp.cjs.claude.agents
Network endpoints1
memory.whalent.com
Decision evidence
public snapshotAI called this Suspicious at 66.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes only the user-run whalent bin at dist/index.cjs and has no preinstall, install, or postinstall hook.
- dist/mcp.cjs is an obfuscated runtime bundle that fetches a host checked against memory.whalent.com and maps platforms to .claude or .agents from the user home.
- The same-version optional dependency is the sibling package @whalent/agent-core, not a nested install of @whalent/agent.
Evidence against
- No automatic npm lifecycle hook mutates agent config or runs on install.
- The visible fetch host matches the Whalent Memory product named in the package.
- No hidden recipient, credential copy, or self-install chain was readable in the inspected source.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
7 flagged · loading sourcedist/mcp.cjsView file
1#!/usr/bin/env node
L2: 'use strict';var a0_0x4d2c8f=a0_0x51ae;(function(_0x531c35,_0x1b96bb){var _0x36dcdc=a0_0x51ae,_0x573707=_0x531c35();while(!![]){try{var _0x1fb484=parseInt(_0x36dcdc(0x1639))/0x1*(-...
L3: || (${_0x4aa734} == "string" && ${_0x50c550} && ${_0x50c550} == +${_0x50c550})`)['assign'](_0x823a3,(0x0,_0x58f25c['_'])`+${_0x50c550}`);return;case _0x10a1fa(0x319):_0x506935['els...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/mcp.cjsView on unpkg4|| (${_0x4aa734} === "string" && ${_0x50c550} && ${_0x50c550} == +${_0x50c550} && !(${_0x50c550} % 1))`)['assign'](_0x823a3,(0x0,_0x58f25c['_'])`+${_0x50c550}`);return;case'boolean...
L5: || ${_0x4aa734} === "boolean" || ${_0x50c550} === null`)['assign'](_0x823a3,(0x0,_0x58f25c['_'])`[${_0x50c550}]`);}}}function _0x3d2afc({gen:_0x1abba0,parentData:_0x200fe7,parentDa...
L6: missingProperty: ${_0x2c436c},
Medium
Findings
3 High7 Medium7 Low
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/core.cjs
MediumOversized Cli Entrypointdist/core.cjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcp.cjs
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @whalent/agent@0.3.457.
See all versions of @whalent/agent for other recorded verdicts.
- Review the evidence and your use of @whalent/agent@0.3.457 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.