@infcode/cli-linux-x64-musl@1.0.1
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe CLI bundle contains runtime metrics and a PostHog telemetry client, with a KILO_TELEMETRY_LEVEL control; the snapshot does not establish that users are told about the reporting. No credential theft or other concrete attack behavior was found, so this is a telemetry warning rather than a block.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
CLI startup and command setup.
Impact
Usage and performance information may be reported to the analytics service. The package snapshot does not establish whether this telemetry is disclosed to users.
Mechanism
The CLI records first-start and resource metrics; a bundled PostHog client reports events with an identity to its configured analytics host. KILO_TELEMETRY_LEVEL provides a runtime control.
AI rationale
The CLI bundle contains runtime metrics and a PostHog telemetry client, with a KILO_TELEMETRY_LEVEL control; the snapshot does not establish that users are told about the reporting. No credential theft or other concrete attack behavior was found, so this is a telemetry warning rather than a block.
Evidence
bin/infcode.mapbin/chunk-tjr7yc9z.js.mapAuthStorage.dir()/metrics/first-install.json
Network endpoints1
us.i.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 80.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI records a first-start product-install metric during command setup.
- Its bundled telemetry client sends events with a distinct ID and optional organization ID to https://us.i.posthog.com.
- KILO_TELEMETRY_LEVEL can disable telemetry unless set to "all"; the default depends on the caller's enabled option.
Evidence against
- package.json declares no lifecycle scripts or package entry points.
- The DeepMap helper sends requests only after an explicit list, search, or ask command, using its configured URL and token.
- No credential theft, unrelated account actions, or install-time behavior was identified.
Behavioral surface
EvalNetwork
NoLicense
Source & flagged code
9 flaggedbin/event_tracking_rs_bg.mjsView file
2351export function __wbg_new_no_args_ee98eee5275000a4(arg0, arg1) {
L2352: const ret = new Function(getStringFromWasm0(arg0, arg1));
L2353: return ret;
Low
Eval
Package source references a known benign dynamic code generation pattern.
bin/event_tracking_rs_bg.mjsView on unpkg · L2351bin/rgView file
•path = bin/rg
kind = native_binary
sizeBytes = 5445512
magicHex = [redacted]
Medium
bin/tree-sitter/tree-sitter-elm.wasmView file
•
Findings
1 High9 Medium2 Low
HighKnown Malware Source Similaritybin/image-runtime/node_modules/sharp/dist/constructor.cjs
MediumNetwork
MediumShips Native Binarybin/rg
MediumShips Wasm Modulebin/tree-sitter/tree-sitter-elm.wasm
MediumShips Build Helperbin/deepmap-skill/scripts/deepmap.sh
MediumStructural Risk Force Deep Review
MediumAi Review Evidencebin/infcode.map
MediumAi Review Evidencebin/chunk-tjr7yc9z.js.map
MediumAi Review Evidencebin/chunk-tjr7yc9z.js.map
MediumAi Review Evidencebin/chunk-tjr7yc9z.js.map
LowEvalbin/event_tracking_rs_bg.mjs
LowNo License
Affected versions and remediation
This report applies to @infcode/cli-linux-x64-musl@1.0.1.
See all versions of @infcode/cli-linux-x64-musl for other recorded verdicts.
- Review the evidence and your use of @infcode/cli-linux-x64-musl@1.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.