registry / @whalent/agent / 0.3.521
@whalent/agent@0.3.521
Stable wrapper for Whalent Agent core runtime
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package has no automatic install hook, and the observed agent integration routines are not enough to establish malicious behavior. Their consent boundary remains unclear, so warn about the agent extension lifecycle capability.
Static reason
One or more suspicious static signals were detected.
Trigger
The daemon MCP entrypoint starts with a token; the specific caller for skill or configuration changes is unclear in the obfuscated bundle.
Impact
These changes can alter agent extensions or MCP configuration, but the inspected source does not confirm unconsented activation or a concrete attack.
Mechanism
The routines can fetch skill content, write it into resolved agent skill directories, and write MCP server entries to `.claude.json`.
AI rationale
The package has no automatic install hook, and the observed agent integration routines are not enough to establish malicious behavior. Their consent boundary remains unclear, so warn about the agent extension lifecycle capability.
Evidence
dist/mcp.cjs.claude.json
Decision evidence
public snapshotAI called this Suspicious at 75.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes a CLI and marks `dist/index.cjs` as its main entrypoint.
- Its only publishing lifecycle hook runs a build command; the manifest has no install hook.
- The MCP bundle contains routines that install files into machine or workspace agent skill directories and fetch skill content using a bearer token.
- The bundle also contains a routine that writes MCP server entries to `.claude.json`.
- The daemon MCP entrypoint checks for a token before starting.
Evidence against
- The manifest does not configure automatic install-time activation of these routines.
- The inspected source does not establish whether skill or configuration changes require a separate confirmation.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
8 flagged · loading sourcedist/mcp.cjsView file
4|| (${_0x1589a4} === "string" && ${_0x270fa9} && ${_0x270fa9} == +${_0x270fa9} && !(${_0x270fa9} % 1))`)[_0x439bd1(0x160d)](_0x648275,(0x0,_0x39dc03['_'])`+${_0x270fa9}`);return;ca...
L5: || ${_0x1589a4} === "boolean" || ${_0x270fa9} === null`)[_0x439bd1(0x160d)](_0x648275,(0x0,_0x39dc03['_'])`[${_0x270fa9}]`);}}}function _0x22c122({gen:_0x1da907,parentData:_0xb481f...
L6: missingProperty: ${_0x5823e2},
L7: depsCount: ${_0x304dbb},
L8: deps: ${_0x39e883}}`};var _0x3a3173={'keyword':_0x3fff6b(0x99e),'type':'object','schemaType':_0x3fff6b(0x539),'error':_0x57c268['error'],'code'(_0xa20888){const [_0x5d04d5,_0x4cc90...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/mcp.cjsView on unpkg · L41#!/usr/bin/env node
L2: 'use strict';var a0_0x12586f=a0_0x22f1;(function(_0x50d96a,_0x48104e){var _0x187796=a0_0x22f1,_0x314fd2=_0x50d96a();while(!![]){try{var _0x560cc0=-parseInt(_0x187796(0x7af))/0x1+-p...
L3: || (${_0x1589a4} == "string" && ${_0x270fa9} && ${_0x270fa9} == +${_0x270fa9})`)[_0x439bd1(0x160d)](_0x648275,(0x0,_0x39dc03['_'])`+${_0x270fa9}`);return;case _0x439bd1(0x1a60):_0x...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1•
Findings
4 High7 Medium7 Low
HighSame File Env Network Executiondist/mcp.cjs
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/core.cjs
MediumOversized Cli Entrypointdist/core.cjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcp.cjs
LowFilesystem
Affected versions and remediation
This report applies to @whalent/agent@0.3.521.
See all versions of @whalent/agent for other recorded verdicts.
- Review the evidence and your use of @whalent/agent@0.3.521 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.