registry / @whalent/agent / 0.3.463
@whalent/agent@0.3.463
Stable wrapper for Whalent Agent core runtime
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe package has no install lifecycle hook, but its MCP daemon includes active AI-agent configuration primitives with broad caller-supplied settings. Static inspection did not prove an automatic or malicious activation path.
Static reason
One or more suspicious static signals were detected.
Trigger
A caller must start the MCP daemon and invoke its exposed tool functionality.
Impact
A permitted caller could alter an AI-agent MCP configuration; no confirmed unconsented activation or credential export was established.
Mechanism
The bundle selects agent configuration directories and writes caller-supplied MCP command, arguments, environment, or URL settings.
AI rationale
The package has no install lifecycle hook, but its MCP daemon includes active AI-agent configuration primitives with broad caller-supplied settings. Static inspection did not prove an automatic or malicious activation path.
Evidence
dist/mcp.cjs.claude.json
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest contains build and publish scripts but no automatic install lifecycle hook.
- The MCP bundle selects Claude, Cursor, or generic agent directories under the user home directory.
- The MCP bundle constructs Claude MCP server entries with caller-provided command, arguments, environment, or URL fields, then writes configuration.
- The daemon exposes MCP tool-call handling, so its configuration capability is an active service feature rather than package-install behavior.
Evidence against
- No automatic npm install trigger was found in the manifest.
- No confirmed secret export, destructive action, or unconsented configuration write was traced from package installation.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
7 flagged · loading sourcedist/mcp.cjsView file
1#!/usr/bin/env node
L2: 'use strict';var a0_0x527510=a0_0x2b31;(function(_0x3abeb5,_0x259123){var _0x4a988d=a0_0x2b31,_0x449c0a=_0x3abeb5();while(!![]){try{var _0x3c0e3f=parseInt(_0x4a988d(0x82d))/0x1+-pa...
L3: || (${_0x5c3801} == "string" && ${_0x1dbc2a} && ${_0x1dbc2a} == +${_0x1dbc2a})`)[_0x15ffe4(0x482)](_0x340a41,(0x0,_0x1f5044['_'])`+${_0x1dbc2a}`);return;case _0x15ffe4(0x15ac):_0x2...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/mcp.cjsView on unpkg4|| (${_0x5c3801} === "string" && ${_0x1dbc2a} && ${_0x1dbc2a} == +${_0x1dbc2a} && !(${_0x1dbc2a} % 1))`)[_0x15ffe4(0x482)](_0x340a41,(0x0,_0x1f5044['_'])`+${_0x1dbc2a}`);return;cas...
L5: || ${_0x5c3801} === "boolean" || ${_0x1dbc2a} === null`)['assign'](_0x340a41,(0x0,_0x1f5044['_'])`[${_0x1dbc2a}]`);}}}function _0x2b648b({gen:_0x507e99,parentData:_0x1f696e,parentD...
L6: missingProperty: ${_0x5161fe},
Medium
Findings
3 High7 Medium7 Low
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/core.cjs
MediumOversized Cli Entrypointdist/core.cjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcp.cjs
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @whalent/agent@0.3.463.
See all versions of @whalent/agent for other recorded verdicts.
- Review the evidence and your use of @whalent/agent@0.3.463 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.