@whalent/agent@0.3.458
Stable wrapper for Whalent Agent core runtime
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package does not automatically execute during npm installation, so the evidence does not support a block. Its obfuscated command runtime can globally replace its wrapper at runtime and alter MCP configuration, warranting a warning.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the whalent command or invokes its MCP configuration functionality.
Impact
A runtime-selected package release can replace the global wrapper, and MCP configuration can be changed. No covert exfiltration or automatic install-time mutation was confirmed.
Mechanism
The runtime uses a spawned npm global-install command for the wrapper package; MCP helpers update configuration objects and write them to disk.
AI rationale
The package does not automatically execute during npm installation, so the evidence does not support a block. Its obfuscated command runtime can globally replace its wrapper at runtime and alter MCP configuration, warranting a warning.
Evidence
dist/index.cjsdist/mcp.cjs
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes a whalent command-line entrypoint.
- The command runtime contains an updater that invokes npm with a global install of the wrapper package and a selected version.
- The MCP runtime can write Claude MCP server configuration entries.
Evidence against
- package.json contains no preinstall, install, or postinstall lifecycle hook.
- The inspected MCP credential request uses a token supplied through command-line or environment configuration for its configured platform URL.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
NoLicense
Source & flagged code
7 flagged · loading sourcedist/mcp.cjsView file
1#!/usr/bin/env node
L2: 'use strict';var a0_0x4654a5=a0_0x4e5a;(function(_0x795c1b,_0x5961e9){var _0x5bdb1b=a0_0x4e5a,_0x51edee=_0x795c1b();while(!![]){try{var _0x4fdaeb=-parseInt(_0x5bdb1b(0x107c))/0x1*(...
L3: || (${_0x4baff5} == "string" && ${_0x54f400} && ${_0x54f400} == +${_0x54f400})`)['assign'](_0x138ba1,(0x0,_0x38ea62['_'])`+${_0x54f400}`);return;case'integer':_0x5cb50a[_0x210e07(0...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/mcp.cjsView on unpkg4|| (${_0x4baff5} === "string" && ${_0x54f400} && ${_0x54f400} == +${_0x54f400} && !(${_0x54f400} % 1))`)[_0x210e07(0x1757)](_0x138ba1,(0x0,_0x38ea62['_'])`+${_0x54f400}`);return;ca...
L5: || ${_0x4baff5} === "boolean" || ${_0x54f400} === null`)[_0x210e07(0x1757)](_0x138ba1,(0x0,_0x38ea62['_'])`[${_0x54f400}]`);}}}function _0x553e78({gen:_0x133ab2,parentData:_0x5bdd1...
L6: missingProperty: ${_0x11c40e},
Medium
Findings
3 High7 Medium7 Low
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/core.cjs
MediumOversized Cli Entrypointdist/core.cjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcp.cjs
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @whalent/agent@0.3.458.
See all versions of @whalent/agent for other recorded verdicts.
- Review the evidence and your use of @whalent/agent@0.3.458 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.