@whalent/agent@0.3.502
Stable wrapper for Whalent Agent core runtime
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe package has no consumer install lifecycle hook, and the suspicious signals do not establish malicious behavior. The obfuscated bundle's agent skill installation capability has unresolved activation and consent behavior, supporting a warning.
Static reason
One or more suspicious static signals were detected.
Trigger
An unresolved caller to the bundle's skill installation function; the relevant activation path could not be verified from the bounded excerpts.
Impact
If exposed and invoked, it can add files to agent configuration directories; no evidence establishes that it executes or persists without user action.
Mechanism
The function resolves a destination, creates its directory, and delegates writing skill files.
AI rationale
The package has no consumer install lifecycle hook, and the suspicious signals do not establish malicious behavior. The obfuscated bundle's agent skill installation capability has unresolved activation and consent behavior, supporting a warning.
Evidence
dist/mcp.cjs
Decision evidence
public snapshotAI called this Suspicious at 72.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest declares only a prepublishOnly lifecycle hook, which runs during publishing rather than consumer installation.
- The MCP bundle maps skill destinations to Claude, Cursor, or generic agent directories under the user home.
- Its skill installer creates the resolved directory and writes skill files when invoked.
- The bundle is heavily obfuscated, limiting verification of how the skill installer is exposed and activated.
Evidence against
- The inspected manifest has no preinstall, install, or postinstall hook.
- The inspected skill installer is a capability in the MCP bundle; no evidence here shows it runs automatically on package installation.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
7 flagged · loading sourcedist/mcp.cjsView file
1#!/usr/bin/env node
L2: 'use strict';var a0_0x426cb6=a0_0x2126;(function(_0x5a7c96,_0x336825){var _0x40cd63=a0_0x2126,_0x4f7a81=_0x5a7c96();while(!![]){try{var _0x39e8f9=-parseInt(_0x40cd63(0x2197))/0x1*(...
L3: || (${_0x3f311d} == "string" && ${_0x294bc5} && ${_0x294bc5} == +${_0x294bc5})`)['assign'](_0x1e8714,(0x0,_0x3c5bbb['_'])`+${_0x294bc5}`);return;case _0x582e72(0x20e2):_0x318f74[_0...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/mcp.cjsView on unpkg4|| (${_0x3f311d} === "string" && ${_0x294bc5} && ${_0x294bc5} == +${_0x294bc5} && !(${_0x294bc5} % 1))`)['assign'](_0x1e8714,(0x0,_0x3c5bbb['_'])`+${_0x294bc5}`);return;case _0x582...
L5: || ${_0x3f311d} === "boolean" || ${_0x294bc5} === null`)['assign'](_0x1e8714,(0x0,_0x3c5bbb['_'])`[${_0x294bc5}]`);}}}function _0x2d9060({gen:_0x5c8c41,parentData:_0x15121a,parentD...
L6: missingProperty: ${_0x526d82},
Medium
Findings
3 High7 Medium7 Low
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/core.cjs
MediumOversized Cli Entrypointdist/core.cjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcp.cjs
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @whalent/agent@0.3.502.
See all versions of @whalent/agent for other recorded verdicts.
- Review the evidence and your use of @whalent/agent@0.3.502 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.