@infcode/cli-windows-arm64@1.0.2
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package manifest has no lifecycle scripts or JS entrypoint, and the inspected credential storage points to the product’s own service. The bundled CLI includes PostHog telemetry for session and usage metadata, but the excerpts do not establish whether it is enabled by default; this warrants a warning rather than a block.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
CLI startup and session events, if telemetry is enabled by its caller or runtime configuration.
Impact
Session identifiers and usage metadata may be sent to the analytics service; the available evidence does not show credentials or user content being transmitted.
Mechanism
The source initializes PostHog at us.i.posthog.com and defines events that include session and model usage metadata. The inspected excerpt does not establish the default telemetry option at the caller.
AI rationale
The package manifest has no lifecycle scripts or JS entrypoint, and the inspected credential storage points to the product’s own service. The bundled CLI includes PostHog telemetry for session and usage metadata, but the excerpts do not establish whether it is enabled by default; this warrants a warning rather than a block.
Evidence
bin/chunk-c00h29yx.js.map
Network endpoints1
us.i.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 77.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The manifest contains only the Windows and ARM64 selectors; it declares no install hooks or JS entrypoint.
- The bundled CLI source configures PostHog at us.i.posthog.com and initializes telemetry with an enabled option controlled by runtime settings.
- Telemetry events include session IDs, model and provider names, message counts, token counts, and session duration.
Evidence against
- The executable’s auth storage uses the product service at www.tokensinfinity.com; no credential theft was identified in the inspected excerpts.
- The binary is a platform-specific CLI artifact, consistent with the package name and manifest.
Behavioral surface
EvalNetwork
NoLicense
Source & flagged code
9 flaggedbin/event_tracking_rs_bg.mjsView file
2351export function __wbg_new_no_args_ee98eee5275000a4(arg0, arg1) {
L2352: const ret = new Function(getStringFromWasm0(arg0, arg1));
L2353: return ret;
Low
Eval
Package source references a known benign dynamic code generation pattern.
bin/event_tracking_rs_bg.mjsView on unpkg · L2351bin/infcode.exeView file
•path = bin/infcode.exe
kind = native_binary
sizeBytes = 133963776
magicHex = [redacted]
Medium
bin/tree-sitter/tree-sitter-elm.wasmView file
Findings
1 High9 Medium2 Low
HighKnown Malware Source Similaritybin/image-runtime/node_modules/sharp/dist/constructor.cjs
MediumNetwork
MediumShips Native Binarybin/infcode.exe
MediumShips Wasm Modulebin/tree-sitter/tree-sitter-elm.wasm
MediumShips Build Helperbin/deepmap-skill/scripts/deepmap.sh
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencebin/chunk-c00h29yx.js.map
MediumAi Review Evidencebin/chunk-c00h29yx.js.map
MediumAi Review Evidencebin/chunk-c00h29yx.js.map
LowEvalbin/event_tracking_rs_bg.mjs
LowNo License
Affected versions and remediation
This report applies to @infcode/cli-windows-arm64@1.0.2.
See all versions of @infcode/cli-windows-arm64 for other recorded verdicts.
- Review the evidence and your use of @infcode/cli-windows-arm64@1.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.