@infcode/cli-linux-x64@1.0.1
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe source shows automatic, account-linked runtime telemetry enabled by default for release builds, without a disclosed opt-out in the inspected package. I found no evidence of credential theft, install-time abuse, or another malicious attack.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
CLI startup and runtime metric events; queued metrics are flushed during runtime or shutdown.
Impact
Usage and performance data, including account-linked identifiers, leaves the machine. No credential or prompt exfiltration was identified.
Mechanism
Samples CPU and memory, associates events with device and user identity, and sends them through the event-tracking client to the configured service URL or default service.
AI rationale
The source shows automatic, account-linked runtime telemetry enabled by default for release builds, without a disclosed opt-out in the inspected package. I found no evidence of credential theft, install-time abuse, or another malicious attack.
Evidence
bin/infcode.mapbin/chunk-nwbz9pgx.js.map
Network endpoints2
www.tokensinfinity.comINFCODE_EVENT_TRACKING_ENDPOINT (user-configured)
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest declares no lifecycle scripts or package entry points.
- CLI startup starts periodic CPU and memory sampling for metrics.
- Release builds select production metrics tracking by default.
- Metrics events include device and user identity, and use the configured service URL or default to www.tokensinfinity.com.
Evidence against
- The source shows no install-time hook or install-time network activity.
- The inspected telemetry sends metrics events; no source showed credentials, prompts, or file contents being sent.
- The AWS metadata references are in the AWS SDK credential-provider source.
Behavioral surface
EvalNetwork
NoLicense
Source & flagged code
9 flaggedbin/event_tracking_rs_bg.mjsView file
2351export function __wbg_new_no_args_ee98eee5275000a4(arg0, arg1) {
L2352: const ret = new Function(getStringFromWasm0(arg0, arg1));
L2353: return ret;
Low
Eval
Package source references a known benign dynamic code generation pattern.
bin/event_tracking_rs_bg.mjsView on unpkg · L2351bin/rgView file
•path = bin/rg
kind = native_binary
sizeBytes = 5445512
magicHex = [redacted]
Medium
bin/tree-sitter/tree-sitter-elm.wasmView file
•path = bin/tree-sitter/tree-sitter-elm.wasm
kind = wasm_module
sizeBytes = 148886
magicHex = [redacted]
Findings
1 High9 Medium2 Low
HighKnown Malware Source Similaritybin/image-runtime/node_modules/sharp/dist/constructor.cjs
MediumNetwork
MediumShips Native Binarybin/rg
MediumShips Wasm Modulebin/tree-sitter/tree-sitter-elm.wasm
MediumShips Build Helperbin/deepmap-skill/scripts/deepmap.sh
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencebin/infcode.map
MediumAi Review Evidencebin/infcode.map
MediumAi Review Evidencebin/chunk-nwbz9pgx.js.map
LowEvalbin/event_tracking_rs_bg.mjs
LowNo License
Affected versions and remediation
This report applies to @infcode/cli-linux-x64@1.0.1.
See all versions of @infcode/cli-linux-x64 for other recorded verdicts.
- Review the evidence and your use of @infcode/cli-linux-x64@1.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.