Which versions of @whalent/agent-core are malicious?

The following npm versions of @whalent/agent-core are flagged malicious: 0.3.230, 0.3.231, 0.3.232, 0.3.233. Treat any of these as compromised.

How do I remediate @whalent/agent-core if I installed it?

Remove @whalent/agent-core from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed @whalent/agent-core — how do I know if it already compromised me?

If @whalent/agent-core was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is @whalent/agent-core part of a known attack campaign?

Yes — @whalent/agent-core is associated with the IN-MAL-2026-010759, IN-MAL-2026-010756, IN-MAL-2026-010752, IN-MAL-2026-010744 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @whalent/agent-core across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @whalent/agent-core (4 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @whalent/agent-core across your stack and pipelines.

Malicious package

@whalent/agent-corenpm

Malicious code in @whalent/agent-core (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-10722

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @whalent/agent-core

What this malware does

The package's bundled runtime (dist/index.cjs) opens a WebSocket to a hardcoded gateway at wss://memory.whalent.com/gw/sdk/ws and integrates with node-pty and child_process spawn to run terminal sessions (SHELL / ComSpec, WHALENT_TERMINAL_BACKEND). Bytes arriving from that gateway drive a PTY on the installer's host, giving the gateway operator arbitrary command execution on any machine that runs this package. The README explicitly states the package is 'replaced by remote daemon upgrades,' meaning code arriving from the same author-controlled endpoint can swap the installed runtime with no visible version/signature pinning — a remote code-update channel over the same gateway. The runtime additionally references AI-provider session paths (claude.ai/settings/usage with session_id, chatgpt.com, api.openai.com/auth, ~/.claude and ~/.codex including settings.local, and ANTHROPIC_API_KEY) alongside POST/GET calls to https://memory.whalent.com/pt, indicating flow of AI-provider session identifiers and API keys from local config to the same hardcoded host. The entire 4.8 MB bundle is wrapped in obfuscator.io-style string-array indirection (rotated array a0_0x375d of length 14337, ~60485 decoder wrappers, ~53169 inlined decoded strings), reconstructing network destinations and command strings at runtime and hiding these behaviors from casual review.

Malicious versions

4 flagged

0.3.2300.3.2310.3.2320.3.233

Indicators of compromise (SHA-256)

46be592c948ce3d8346e8df384e2925b3d3d6011079b1033257395bc6f989f4e

96088bf0c797b908d17f5ac937e019a9c65a8f7c02a9fe5d78e32b2dc5f64e8f

dfa859fe59b5a5e6139dfb586748a1a49a1dbf95e1a4df9dd9360d54e358b632

dfd40ffe52986a560961c8d4d9d7a3ec526813f9a2f335cef9c6884ca9f6d2cf

Detection & response playbook

Malicious package

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @whalent/agent-core (4 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @whalent/agent-core across your stack and pipelines.
If you installed it — respond
Remove @whalent/agent-core from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If @whalent/agent-core was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @whalent/agent-core before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. @whalent/agent-core on npm has been identified as a malicious package (versions 0.3.230, 0.3.231, 0.3.232, 0.3.233 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-010759IN-MAL-2026-010756IN-MAL-2026-010752IN-MAL-2026-010744

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks @whalent/agent-core-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring