registry / @whalent/agent / 0.3.470
@whalent/agent@0.3.470
Stable wrapper for Whalent Agent core runtime
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe package exposes a guarded capability to alter AI-agent MCP configuration with caller-supplied launch details. This warrants a warning for agent-extension lifecycle risk, not a block, because no automatic or covert activation was found.
Static reason
One or more suspicious static signals were detected.
Trigger
A caller invokes the MCP server registration action.
Impact
A permitted MCP caller could cause a supported agent to launch a configured command later.
Mechanism
The handler accepts command, arguments, and environment data and writes an MCP-server configuration entry.
AI rationale
The package exposes a guarded capability to alter AI-agent MCP configuration with caller-supplied launch details. This warrants a warning for agent-extension lifecycle risk, not a block, because no automatic or covert activation was found.
Evidence
dist/mcp.cjs
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The MCP handler registers caller-provided command, arguments, and environment values through an MCP configuration injection function.
- The Codex configuration helper creates or rewrites config.toml MCP-server entries.
- Package metadata has build and start scripts but no npm install lifecycle hook.
Evidence against
- No automatic install-time execution was found in package metadata.
- The configuration write requires a request to the running MCP service; no covert default registration was identified.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
NoLicense
Source & flagged code
8 flagged · loading sourcedist/mcp.cjsView file
4|| (${_0x5774e2} === "string" && ${_0x520dc5} && ${_0x520dc5} == +${_0x520dc5} && !(${_0x520dc5} % 1))`)[_0x14c971(0x278)](_0x303abc,(0x0,_0x1f6a24['_'])`+${_0x520dc5}`);return;cas...
L5: || ${_0x5774e2} === "boolean" || ${_0x520dc5} === null`)['assign'](_0x303abc,(0x0,_0x1f6a24['_'])`[${_0x520dc5}]`);}}}function _0x730ac9({gen:_0x5e9b26,parentData:_0x3ea42c,parentD...
L6: missingProperty: ${_0x53f885},
L7: depsCount: ${_0x2c0756},
L8: deps: ${_0x4d7923}}`};var _0x4f6b3d={'keyword':'dependencies','type':_0x514d9a(0x5c6),'schemaType':_0x514d9a(0x5c6),'error':_0x7bbad7['error'],'code'(_0x398850){const [_0x505630,_0...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/mcp.cjsView on unpkg · L41#!/usr/bin/env node
L2: 'use strict';var a0_0xb5f14=a0_0x212d;(function(_0x17e453,_0xc163b6){var _0x190078=a0_0x212d,_0x31607b=_0x17e453();while(!![]){try{var _0x1a895d=parseInt(_0x190078(0x11d1))/0x1+-pa...
L3: || (${_0x5774e2} == "string" && ${_0x520dc5} && ${_0x520dc5} == +${_0x520dc5})`)[_0x14c971(0x278)](_0x303abc,(0x0,_0x1f6a24['_'])`+${_0x520dc5}`);return;case'integer':_0x5a31f0['el...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1•
Findings
4 High7 Medium7 Low
HighSame File Env Network Executiondist/mcp.cjs
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/core.cjs
MediumOversized Cli Entrypointdist/core.cjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcp.cjs
LowFilesystem
Affected versions and remediation
This report applies to @whalent/agent@0.3.470.
See all versions of @whalent/agent for other recorded verdicts.
- Review the evidence and your use of @whalent/agent@0.3.470 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.