MalwarePublished 16 Jul 2026Updated 5 Aug 2026

@whalent/agent-core (npm) · Malicious Code

Affects @whalent/agent-coreSource GCVE Database

Malicious package : remove @whalent/agent-core and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10722

What to do

Remove @whalent/agent-core from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@whalent/agent-core	Affected 0.3.230 – 0.3.298 49 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The @whalent/agent-core npm package contains malicious code that establishes a WebSocket connection to a hardcoded remote gateway, enabling the operator to execute arbitrary commands on any host running the package. The package supports remote code updates from the same gateway without visible version or signature verification. It also exfiltrates AI-provider session identifiers and API keys to the attacker-controlled host. The code is heavily obfuscated to evade casual inspection. This affects specific versions of the package and no official patch or fix is currently documented.

Impact

Hosts running affected versions of @whalent/agent-core are at risk of arbitrary remote code execution by the attacker controlling the hardcoded WebSocket gateway. This allows full command execution capabilities on the compromised system. Furthermore, sensitive AI-provider session identifiers and API keys stored locally may be exfiltrated to the attacker, potentially compromising user accounts and data. The remote code update mechanism enables the attacker to modify or replace the installed runtime without detection, prolonging and escalating the compromise.

Defensive guidance

Users should immediately remove the affected versions of @whalent/agent-core from their environments and avoid installing or running this package. Monitor for any network connections to wss://memory.whalent.com and related domains and investigate any signs of compromise. Since the package supports remote code updates from an attacker-controlled endpoint, any system that has run this package should be considered compromised and undergo thorough incident response and remediation.

Summary

The @whalent/agent-core package (versions =0.3.230, =0.3.231, =0.3.232, =0.3.233, =0.3.254) includes a bundled runtime that opens a WebSocket connection to wss://memory.whalent.com/gw/sdk/ws. This connection allows the remote gateway operator to control a pseudo-terminal (PTY) on the host by sending commands, effectively enabling arbitrary command execution. The package's README indicates that the runtime can be remotely upgraded by the same gateway without any visible version or signature pinning, creating a covert remote code update channel. Additionally, the runtime collects AI-provider session data and API keys from local configuration files and sends them to the attacker-controlled endpoint. The entire 4.8 MB runtime is obfuscated using string-array indirection and numerous decoder wrappers to conceal its malicious behavior.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 17:06 UTC

Technical details

References

Community reviews