npm · registry.npmjs.org

@whalent/agent-core

Install-time lifecycle script, Large Javascript Payload

Early detection

PkgRadar flagged this 1.1 days before public disclosure

Detected 2026-07-15 · disclosed as MAL-2026-10722 on 2026-07-16

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`0.3.233`	High risk	3	2026-08-18
`0.3.231`	High risk	3	2026-08-18
`0.3.349`	Low risk	0	2026-08-17
`0.3.348`	Low risk	0	2026-08-17
`0.3.347`	Low risk	0	2026-08-17
`0.3.346`	Low risk	0	2026-08-17
`0.3.345`	Low risk	0	2026-08-17
`0.3.344`	Low risk	0	2026-08-17
`0.3.343`	Low risk	0	2026-08-17
`0.3.342`	Low risk	0	2026-08-17
`0.3.341`	Low risk	0	2026-08-16
`0.3.340`	Low risk	0	2026-08-16
`0.3.339`	Low risk	0	2026-08-16
`0.3.338`	Low risk	0	2026-08-15
`0.3.336`	Low risk	0	2026-08-15
`0.3.335`

Block this in CI

PkgRadar gates @whalent/agent-core (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @whalent/[email protected]