registry / @whalent/agent / 0.3.503
@whalent/agent@0.3.503
⚠ Under reviewStable wrapper for Whalent Agent core runtime
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe manifest does not show an npm install hook, but the shipped runtime is heavily obfuscated and includes an agent skill installation path whose activation and safeguards could not be resolved. The evidence is insufficient to classify the package as clean or malicious.
Static reason
One or more suspicious static signals were detected.
Trigger
Unknown; the relevant caller and activation path could not be traced in the obfuscated bundle.
Impact
An unsafe or unconsented caller could expose a token or install agent skill content, but the inspected source does not establish that this occurs.
Mechanism
A helper writes supplied skill files under a resolved platform directory, while another helper sends a bearer token to a URL assembled from a runtime-provided base.
AI rationale
The manifest does not show an npm install hook, but the shipped runtime is heavily obfuscated and includes an agent skill installation path whose activation and safeguards could not be resolved. The evidence is insufficient to classify the package as clean or malicious.
Evidence
dist/mcp.cjs
Decision evidence
public snapshotAI called this Manual Review at 67.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The flagged location in dist/mcp.cjs selects platform skill directories, including paths under the user home or an agent-managed location, but its obfuscated context does not reveal activation or consent.
- The bundle has a skill installer that writes supplied file maps and a downloader that sends a bearer token to a URL built from a runtime-provided base; the caller chain and effective destination remain unclear.
- The main entrypoint is heavily obfuscated, and the package manifest lists only bundled distribution files, limiting reliable tracing of runtime behavior.
Evidence against
- The inspected manifest shows a prepublishOnly build command; no preinstall, install, or postinstall hook appears in its script list.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscated
Source & flagged code
7 flagged · loading sourcedist/mcp.cjsView file
1#!/usr/bin/env node
L2: 'use strict';var a0_0x1c7a45=a0_0x2895;(function(_0xffd044,_0x3ebd29){var _0x1dd9e5=a0_0x2895,_0x2ed923=_0xffd044();while(!![]){try{var _0x2a95a9=-parseInt(_0x1dd9e5(0x12f2))/0x1*(...
L3: || (${_0x41ec9b} == "string" && ${_0x3fc918} && ${_0x3fc918} == +${_0x3fc918})`)[_0x548122(0x1585)](_0x57b596,(0x0,_0x4768cb['_'])`+${_0x3fc918}`);return;case _0x548122(0xbb6):_0x5...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/mcp.cjsView on unpkg4|| (${_0x41ec9b} === "string" && ${_0x3fc918} && ${_0x3fc918} == +${_0x3fc918} && !(${_0x3fc918} % 1))`)['assign'](_0x57b596,(0x0,_0x4768cb['_'])`+${_0x3fc918}`);return;case'boolea...
L5: || ${_0x41ec9b} === "boolean" || ${_0x3fc918} === null`)['assign'](_0x57b596,(0x0,_0x4768cb['_'])`[${_0x3fc918}]`);}}}function _0x12ff84({gen:_0x7f912b,parentData:_0x227d09,parentD...
L6: missingProperty: ${_0x55f12e},
Medium
Findings
3 High7 Medium7 Low
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/core.cjs
MediumOversized Cli Entrypointdist/core.cjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcp.cjs
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @whalent/agent@0.3.503.
See all versions of @whalent/agent for other recorded verdicts.
- Review the evidence and your use of @whalent/agent@0.3.503 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.