registry / @whalent/agent / 0.3.510
@whalent/agent@0.3.510
⚠ Under reviewStable wrapper for Whalent Agent core runtime
AI Security Review
scanned 8d ago · by lpm-firewall-aiStatic inspection found a potentially consequential agent skill installation capability, but could not establish its reachability or consent boundary in the obfuscated bundle. The manifest shows no npm install-time hook, so the available evidence does not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Unresolved; no activating caller was confirmed by static inspection.
Impact
If reachable without an effective consent boundary, it could add or update agent skill files; the resulting behavior is unresolved.
Mechanism
The helper downloads skill content and writes files into selected agent skill directories.
AI rationale
Static inspection found a potentially consequential agent skill installation capability, but could not establish its reachability or consent boundary in the obfuscated bundle. The manifest shows no npm install-time hook, so the available evidence does not establish malicious behavior.
Evidence
dist/mcp.cjs
Decision evidence
public snapshotAI called this Manual Review at 58.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest has a prepublish-only build hook, with no preinstall, install, or postinstall hook.
- The MCP bundle defines a helper that downloads skill files using a bearer token and a service base passed to the helper.
- The bundle contains a helper that writes downloaded files into agent skill directories, including workspace and home-directory scopes.
- The entrypoint and MCP bundle are heavily obfuscated, and static inspection did not resolve the skill helpers’ callers or consent boundary.
Evidence against
- The installer checks file paths and skips paths that escape the selected skill directory.
- The manifest points the package entrypoint and command aliases to dist/index.cjs; the skill helpers are in dist/mcp.cjs.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscated
Source & flagged code
7 flagged · loading sourcedist/mcp.cjsView file
1#!/usr/bin/env node
L2: 'use strict';var a0_0x16723a=a0_0x76d7;(function(_0x2e56df,_0xefa0ec){var _0x5ce7da=a0_0x76d7,_0x108a9d=_0x2e56df();while(!![]){try{var _0x55f4ab=parseInt(_0x5ce7da(0xd8c))/0x1+par...
L3: || (${_0x8c4473} == "string" && ${_0xdb4442} && ${_0xdb4442} == +${_0xdb4442})`)[_0x391f46(0x1735)](_0x3c3614,(0x0,_0xefe55['_'])`+${_0xdb4442}`);return;case _0x391f46(0x1255):_0x5...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/mcp.cjsView on unpkg4|| (${_0x8c4473} === "string" && ${_0xdb4442} && ${_0xdb4442} == +${_0xdb4442} && !(${_0xdb4442} % 1))`)['assign'](_0x3c3614,(0x0,_0xefe55['_'])`+${_0xdb4442}`);return;case'boolean...
L5: || ${_0x8c4473} === "boolean" || ${_0xdb4442} === null`)['assign'](_0x3c3614,(0x0,_0xefe55['_'])`[${_0xdb4442}]`);}}}function _0x48832a({gen:_0x2b0009,parentData:_0x194644,parentDa...
L6: missingProperty: ${_0x11c8b2},
Medium
Findings
3 High7 Medium7 Low
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/core.cjs
MediumOversized Cli Entrypointdist/core.cjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcp.cjs
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @whalent/agent@0.3.510.
See all versions of @whalent/agent for other recorded verdicts.
- Review the evidence and your use of @whalent/agent@0.3.510 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.