@whalent/agentnpm
Advisory published Updated
@whalent/agent is a confirmed malicious npm package (MAL-2026-10721) that executes malicious code on install (malicious versions 0.3.230, 0.3.231, 0.3.232…). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in @whalent/agent (npm)
What this malware does
The package installs a whalent CLI daemon that opens a persistent WebSocket connection (wss://) to a Whalent Memory gateway and, per its own README, accepts remote commands including 'upgrade' and 'restart' from that gateway. dist/index.cjs contains an npmInstallCommand builder that assembles npm install -g @whalent/agent@<version> --registry=<DEFAULT_NPM_REGISTRY|CHINA_NPM_REGISTRY> strings driven by the gateway's chosen version — meaning whoever controls (or compromises) the gateway can cause the daemon's host to install and execute an arbitrary version of the package as the user running the daemon. The core bundle additionally references process.env.SHELL and localhost RDP/VNC ports (127.0.0.1:3389, 5900, 5901), and the dependency set includes @xterm/headless, node-pty (optional), ssh2, and ws, indicating terminal/PTY and remote-session capability reachable from the same gateway channel. Both dist/index.cjs (main/bin entry) and the 13 MB dist/core.cjs are transformed with javascript-obfuscator (string-array rotator, _0x-named helpers, control-flow flattening), and javascript-obfuscator is listed in devDependencies — the obfuscation covers the gateway command dispatcher and shell sinks. The daemon fires only when the operator explicitly runs whalent --token …, not on npm install or on require(), but once running it provides a network-reachable code-execution and shell surface on the host controlled by the gateway operator.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Search your lockfiles and build artifacts for @whalent/agent (41 malicious versions).
If you installed it — respond
Remove @whalent/agent from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If @whalent/agent was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks @whalent/agent-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.