registry / @infcode/cli-linux-x64-musl / 1.0.2
@infcode/cli-linux-x64-musl@1.0.2
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest has no install hooks or JavaScript entry points, and the visible helper only performs configured DeepMap operations after explicit commands. Runtime telemetry is enabled by default but documented as configurable and opt-out; I found no evidence of malicious collection or transport.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
The CLI runs when invoked; DeepMap requests run only through explicit list, search, or ask commands.
Impact
No automatic credential theft, unrelated collection, or other malicious impact was identified.
Mechanism
DeepMap sends requests to the configured site URL using its configured token. Runtime telemetry goes to PostHog and can be disabled in configuration.
AI rationale
The manifest has no install hooks or JavaScript entry points, and the visible helper only performs configured DeepMap operations after explicit commands. Runtime telemetry is enabled by default but documented as configurable and opt-out; I found no evidence of malicious collection or transport.
Network endpoints2
us.i.posthog.comUser-configured DeepMap site URL
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies a Linux x64 platform package and declares no lifecycle scripts or JavaScript entry points.
- The DeepMap helper runs only when called with the explicit list, search, or ask command and loads its configuration at runtime.
- The helper sends its bearer token to the configured site URL for the requested API operation.
- Telemetry is sent to PostHog; the configuration describes the opt-out setting as “Enable telemetry. Set to false to opt-out.”
- The visible telemetry event fields include session IDs, model/provider names, and token counts; I found no evidence they include prompts or tool output.
Evidence against
- The native CLI executable is opaque to text inspection, though the package is a platform-specific CLI payload.
- Telemetry is enabled by default, with an opt-out setting.
Behavioral surface
EvalNetwork
NoLicense
Source & flagged code
9 flaggedbin/event_tracking_rs_bg.mjsView file
2351export function __wbg_new_no_args_ee98eee5275000a4(arg0, arg1) {
L2352: const ret = new Function(getStringFromWasm0(arg0, arg1));
L2353: return ret;
Low
Eval
Package source references a known benign dynamic code generation pattern.
bin/event_tracking_rs_bg.mjsView on unpkg · L2351bin/rgView file
•path = bin/rg
kind = native_binary
sizeBytes = 5445512
magicHex = [redacted]
Medium
bin/tree-sitter/tree-sitter-elm.wasmView file
•
Findings
1 High5 Medium6 Low
HighKnown Malware Source Similaritybin/image-runtime/node_modules/sharp/dist/constructor.cjs
MediumNetwork
MediumShips Native Binarybin/rg
MediumShips Wasm Modulebin/tree-sitter/tree-sitter-elm.wasm
MediumShips Build Helperbin/deepmap-skill/scripts/deepmap.sh
MediumStructural Risk Force Deep Review
LowEvalbin/event_tracking_rs_bg.mjs
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencebin/deepmap-skill/scripts/deepmap.sh
LowAi Review Evidencebin/deepmap-skill/scripts/deepmap.sh
LowAi Review Evidencebin/chunk-1ezyrddb.js.map
Affected versions and remediation
This report applies to @infcode/cli-linux-x64-musl@1.0.2.
See all versions of @infcode/cli-linux-x64-musl for other recorded verdicts.
- Review the evidence and your use of @infcode/cli-linux-x64-musl@1.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.