registry / @whalent/agent / 0.3.520
@whalent/agent@0.3.520
Stable wrapper for Whalent Agent core runtime
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package declares no install lifecycle hook, and its prepublishOnly script only invokes a build. Obfuscated bundles and an agent skill-writing capability leave an unresolved integration question, but the inspected source does not establish an active attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Unresolved; the inspected excerpts do not show which caller invokes the skill installer.
Impact
Potential agent skill configuration changes if the operation is invoked; no unconsented mutation or malicious effect was confirmed.
Mechanism
The bundle resolves a skill destination and writes files there; the cited code does not establish whether this follows an explicit user request.
AI rationale
The package declares no install lifecycle hook, and its prepublishOnly script only invokes a build. Obfuscated bundles and an agent skill-writing capability leave an unresolved integration question, but the inspected source does not establish an active attack.
Evidence
dist/mcp.cjs
Decision evidence
public snapshotAI called this Suspicious at 69.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes a CLI entrypoint whose bundled source begins with an obfuscated loader.
- The MCP bundle includes code that resolves skill destinations across machine, project, and managed scopes, then creates directories and writes skill files; the inspected excerpt does not establish the caller's consent or full activation path.
- The only publish lifecycle hook shown runs a build command; no install lifecycle hook is declared.
Evidence against
- Skill installation appears to be package functionality in the MCP bundle, but the inspected excerpts do not establish an unconsented lifecycle trigger or a broader control-surface mutation.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
7 flagged · loading sourcedist/mcp.cjsView file
1#!/usr/bin/env node
L2: 'use strict';var a0_0x418fb4=a0_0x24d0;(function(_0x16b343,_0xda2f67){var _0x4553fe=a0_0x24d0,_0x1edf65=_0x16b343();while(!![]){try{var _0x551564=-parseInt(_0x4553fe(0x221d))/0x1*(...
L3: || (${_0x39f180} == "string" && ${_0x22e502} && ${_0x22e502} == +${_0x22e502})`)['assign'](_0x4f5581,(0x0,_0x82bf1d['_'])`+${_0x22e502}`);return;case'integer':_0x468411['elseIf']((...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/mcp.cjsView on unpkg4|| (${_0x39f180} === "string" && ${_0x22e502} && ${_0x22e502} == +${_0x22e502} && !(${_0x22e502} % 1))`)['assign'](_0x4f5581,(0x0,_0x82bf1d['_'])`+${_0x22e502}`);return;case _0x359...
L5: || ${_0x39f180} === "boolean" || ${_0x22e502} === null`)[_0x359258(0x8cf)](_0x4f5581,(0x0,_0x82bf1d['_'])`[${_0x22e502}]`);}}}function _0x366dbf({gen:_0x1a99c7,parentData:_0x5b56e1...
L6: missingProperty: ${_0x1e4315},
Medium
Findings
3 High7 Medium7 Low
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/core.cjs
MediumOversized Cli Entrypointdist/core.cjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcp.cjs
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @whalent/agent@0.3.520.
See all versions of @whalent/agent for other recorded verdicts.
- Review the evidence and your use of @whalent/agent@0.3.520 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.