registry / @whalent/agent / 0.3.497
@whalent/agent@0.3.497
Stable wrapper for Whalent Agent core runtime
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe inspected package metadata and flagged bundle excerpts do not establish malicious behavior, and the manifest has no install-time lifecycle hook. Obfuscation reduces confidence, but the scanner's payload-loader signal is not proof of an active attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Package publication or normal CLI/runtime use.
Impact
No attack effect was confirmed.
Mechanism
The manifest runs a build for prepublishOnly; no install hook is declared. The inspected bundled URL fragment is part of schema-reference code.
AI rationale
The inspected package metadata and flagged bundle excerpts do not establish malicious behavior, and the manifest has no install-time lifecycle hook. Obfuscation reduces confidence, but the scanner's payload-loader signal is not proof of an active attack.
Decision evidence
public snapshotAI called this Clean at 76.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The manifest declares a publish-time build hook, with no install-time lifecycle hook.
- The manifest identifies the package as a Whalent Agent runtime wrapper and lists agent protocol libraries as dependencies.
- The flagged URL fragment occurs in bundled schema-reference code; inspection did not establish a package-controlled payload loader or concrete attack behavior.
Evidence against
- The distributed entrypoints are heavily obfuscated, which limits behavioral review.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
NoLicense
Oversized source lightweight scan
Source & flagged code
7 flagged · loading sourcedist/mcp.cjsView file
1#!/usr/bin/env node
L2: 'use strict';var a0_0x33a327=a0_0x4fca;(function(_0x4ffcbc,_0x4ba1fb){var _0x253c01=a0_0x4fca,_0x348ae6=_0x4ffcbc();while(!![]){try{var _0x293a52=-parseInt(_0x253c01(0x4a8))/0x1*(p...
L3: || (${_0x31fdd1} == "string" && ${_0x358501} && ${_0x358501} == +${_0x358501})`)[_0x4dbfeb(0xce6)](_0x181f54,(0x0,_0x3ed79d['_'])`+${_0x358501}`);return;case'integer':_0x1306c4['el...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/mcp.cjsView on unpkg4|| (${_0x31fdd1} === "string" && ${_0x358501} && ${_0x358501} == +${_0x358501} && !(${_0x358501} % 1))`)[_0x4dbfeb(0xce6)](_0x181f54,(0x0,_0x3ed79d['_'])`+${_0x358501}`);return;cas...
L5: || ${_0x31fdd1} === "boolean" || ${_0x358501} === null`)['assign'](_0x181f54,(0x0,_0x3ed79d['_'])`[${_0x358501}]`);}}}function _0x6ca307({gen:_0x2389b5,parentData:_0x478010,parentD...
L6: missingProperty: ${_0x5f3cf6},
Medium
Findings
3 High7 Medium7 Low
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/core.cjs
MediumOversized Cli Entrypointdist/core.cjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcp.cjs
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @whalent/agent@0.3.497.
See all versions of @whalent/agent for other recorded verdicts.
- Review the evidence and your use of @whalent/agent@0.3.497 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.