registry / @whalent/agent / 0.3.499
@whalent/agent@0.3.499
Stable wrapper for Whalent Agent core runtime
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe source shows a concrete agent configuration mutation capability, but the heavily obfuscated bundle excerpts do not establish its activation path or consent guard. This warrants a warning for agent extension lifecycle risk, not a finding of malicious installation behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
An unobserved caller invoking the skill installer; no npm install trigger was found in the inspected manifest.
Impact
It can add or replace agent skill files in the selected directory; the inspected source does not establish automatic execution or a confirmed attack.
Mechanism
The installer resolves an agent skill directory, creates it, and writes skill files after checking paths.
AI rationale
The source shows a concrete agent configuration mutation capability, but the heavily obfuscated bundle excerpts do not establish its activation path or consent guard. This warrants a warning for agent extension lifecycle risk, not a finding of malicious installation behavior.
Evidence
dist/mcp.cjsagent skill directories under `.cursor` and `.agents`
Decision evidence
public snapshotAI called this Suspicious at 73.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The bundle resolves skill installation destinations under agent directories such as `.cursor` and `.agents`, using a home directory derived from environment variables.
- The bundle writes skill files to the resolved directory after checking file paths, establishing an agent configuration mutation capability.
- The package manifest declares only a `prepublishOnly` build hook; it does not establish install-time execution of the skill installer.
Evidence against
- The inspected skill installer is a callable package capability; the inspected excerpts do not establish that npm installation triggers it or that it runs without user action.
- The path helper checks that skill file paths remain inside the selected destination.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscated
Source & flagged code
7 flagged · loading sourcedist/mcp.cjsView file
1#!/usr/bin/env node
L2: 'use strict';var a0_0x707cc7=a0_0x3971;(function(_0xf80c5e,_0x4f75c8){var _0x30746d=a0_0x3971,_0x5bb682=_0xf80c5e();while(!![]){try{var _0x5934eb=parseInt(_0x30746d(0x1a80))/0x1+pa...
L3: || (${_0x1662f7} == "string" && ${_0x54a595} && ${_0x54a595} == +${_0x54a595})`)['assign'](_0x498d85,(0x0,_0x215022['_'])`+${_0x54a595}`);return;case _0x3fcdef(0x20fb):_0x24d7e5['e...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/mcp.cjsView on unpkg4|| (${_0x1662f7} === "string" && ${_0x54a595} && ${_0x54a595} == +${_0x54a595} && !(${_0x54a595} % 1))`)[_0x3fcdef(0x1831)](_0x498d85,(0x0,_0x215022['_'])`+${_0x54a595}`);return;ca...
L5: || ${_0x1662f7} === "boolean" || ${_0x54a595} === null`)[_0x3fcdef(0x1831)](_0x498d85,(0x0,_0x215022['_'])`[${_0x54a595}]`);}}}function _0x3c79a6({gen:_0x82f37e,parentData:_0xb32ef...
L6: missingProperty: ${_0x20411a},
Medium
Findings
3 High7 Medium7 Low
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/core.cjs
MediumOversized Cli Entrypointdist/core.cjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcp.cjs
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @whalent/agent@0.3.499.
See all versions of @whalent/agent for other recorded verdicts.
- Review the evidence and your use of @whalent/agent@0.3.499 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.