Malicious Package Affecting @whalent/agent package, versions =0.3.265=0.3.254=0.3.232=0.3.249=0.3.234=0.3.241=0.3.230=0.3.261=0.3.268=0.3.248=0.3.235=0.3.255=0.3.238=0.3.250=0.3.252=0.3.233=0.3.243=0.3.263=0.3.239=0.3.240=0.3.251=0.3.247=0.3.264=0.3.269=0.3.244=0.3.253=0.3.281=0.3.279=0.3.291=0.3.298=0.3.285=0.3.272=0.3.297=0.3.277=0.3.296=0.3.280=0.3.282=0.3.295=0.3.283=0.3.231
Threat Intelligence
Exploit Maturity
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Attacked
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-WHALENTAGENT-18565249
- published6 Aug 2026
- disclosed5 Aug 2026
- creditUnknown
Introduced: 5 Aug 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Avoid using all malicious instances of the @whalent/agent package.
Overview
@whalent/agent is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.