Malicious Package Affecting @whalent/agent-core package, versions =0.3.241=0.3.245=0.3.253=0.3.259=0.3.234=0.3.252=0.3.235=0.3.240=0.3.249=0.3.243=0.3.261=0.3.239=0.3.268=0.3.266=0.3.265=0.3.264=0.3.247=0.3.238=0.3.258=0.3.262=0.3.251=0.3.257=0.3.263=0.3.248=0.3.255=0.3.250=0.3.244=0.3.279=0.3.288=0.3.273=0.3.289=0.3.291=0.3.297=0.3.271=0.3.275=0.3.296=0.3.276=0.3.282=0.3.278=0.3.277=0.3.295=0.3.294=0.3.298=0.3.280=0.3.254=0.3.233=0.3.232=0.3.231=0.3.230
Threat Intelligence
Exploit Maturity
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Attacked
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-WHALENTAGENTCORE-18565245
- published6 Aug 2026
- disclosed5 Aug 2026
- creditUnknown
Introduced: 5 Aug 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Avoid using all malicious instances of the @whalent/agent-core package.
Overview
@whalent/agent-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.