The @whalent/agent-core package (versions =0.3.230, =0.3.231, =0.3.232, =0.3.233, =0.3.254) includes a bundled runtime that opens a WebSocket connection to wss://memory.whalent.com/gw/sdk/ws. This connection allows the remote gateway operator to control a pseudo-terminal (PTY) on the host by sending commands, effectively enabling arbitrary command execution. The package's README indicates that the runtime can be remotely upgraded by the same gateway without any visible version or signature pinning, creating a covert remote code update channel. Additionally, the runtime collects AI-provider session data and API keys from local configuration files and sends them to the attacker-controlled endpoint. The entire 4.8 MB runtime is obfuscated using string-array indirection and numerous decoder wrappers to conceal its malicious behavior.

Hosts running affected versions of @whalent/agent-core are at risk of arbitrary remote code execution by the attacker controlling the hardcoded WebSocket gateway. This allows full command execution capabilities on the compromised system. Furthermore, sensitive AI-provider session identifiers and API keys stored locally may be exfiltrated to the attacker, potentially compromising user accounts and data. The remote code update mechanism enables the attacker to modify or replace the installed runtime without detection, prolonging and escalating the compromise.

No official patch or remediation is currently documented for this malicious package. Users should immediately remove the affected versions of @whalent/agent-core from their environments and avoid installing or running this package. Monitor for any network connections to wss://memory.whalent.com and related domains and investigate any signs of compromise. Since the package supports remote code updates from an attacker-controlled endpoint, any system that has run this package should be considered compromised and undergo thorough incident response and remediation.