registry / @whalent/agent / 0.3.527
@whalent/agent@0.3.527
Stable wrapper for Whalent Agent core runtime
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package exposes a heavily obfuscated executable as its main entry point and command target, while the inspected source did not establish a concrete attack. This unresolved runtime risk supports a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
Running one of the package commands that invokes dist/index.cjs.
Impact
Potential runtime risk remains unresolved; no specific harmful effect was verified.
Mechanism
Obfuscated executable code prevents a reliable static account of the complete runtime behavior.
AI rationale
The package exposes a heavily obfuscated executable as its main entry point and command target, while the inspected source did not establish a concrete attack. This unresolved runtime risk supports a warning rather than a block.
Evidence
dist/index.cjsdist/mcp.cjspackage.jsondist/core.cjs
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- package.json exposes dist/index.cjs as the main entry point and three executable commands.
- The published prepublishOnly hook runs the package build script; it is not an install lifecycle hook.
- The executable entry point and bundled MCP and core files begin with heavily obfuscated code, and static inspection did not resolve their full behavior.
Evidence against
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
NoLicense
Oversized source lightweight scan
dist/core.cjs16.9 MB file, sampled 256 KB
Source & flagged code
7 flagged · loading sourcedist/mcp.cjsView file
1#!/usr/bin/env node
L2: 'use strict';var a0_0x231874=a0_0x330a;function a0_0x460a(){var _0x35d921=['uMvNrxHWtgL0zxjHBa','jtbb','q2fJAgvrDwvYEu9WDgLVBNm','CgfYC2vszxn0rwXLBwvUDa','rxHWB25LBNrPyxrPB24','B25...
L3: || (${_0x616ff2} == "string" && ${_0x3910d3} && ${_0x3910d3} == +${_0x3910d3})`)['assign'](_0x37a9b6,(0x0,_0x51103b['_'])`+${_0x3910d3}`);return;case _0x2210b3(0x2335):_0x5b5a68[_0...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/mcp.cjsView on unpkg · L1•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/mcp.cjsView on unpkg4|| (${_0x616ff2} === "string" && ${_0x3910d3} && ${_0x3910d3} == +${_0x3910d3} && !(${_0x3910d3} % 1))`)['assign'](_0x37a9b6,(0x0,_0x51103b['_'])`+${_0x3910d3}`);return;case'boolea...
L5: || ${_0x616ff2} === "boolean" || ${_0x3910d3} === null`)[_0x2210b3(0x20cd)](_0x37a9b6,(0x0,_0x51103b['_'])`[${_0x3910d3}]`);}}}function _0x2c196b({gen:_0x355514,parentData:_0x1c56f...
L6: missingProperty: ${_0x341cc7},
Medium
Findings
3 High7 Medium7 Low
HighObfuscated Payload Loaderdist/mcp.cjs
HighObfuscated
HighSemantic Analysis Limiteddist/mcp.cjs
MediumDynamic Requiredist/mcp.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/jupyter_sidecar.py
MediumOversized Source Filedist/core.cjs
MediumOversized Cli Entrypointdist/core.cjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcp.cjs
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @whalent/agent@0.3.527.
See all versions of @whalent/agent for other recorded verdicts.
- Review the evidence and your use of @whalent/agent@0.3.527 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.