registry / @infcode/cli-windows-arm64 / 2.7.46-dev-65eb4406-42090
@infcode/cli-windows-arm64@2.7.46-dev-65eb4406-42090
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe manifest declares no install-time execution, and the flagged sharp file is an image-processing constructor. The optional helper sends its configured token to its configured service URL; the inspected source does not establish a package-selected recipient or concrete attack.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
No package lifecycle or JavaScript entrypoint is declared; the optional DeepMap helper runs when invoked by a user.
Impact
No confirmed unauthorized credential transfer, persistence, destructive behavior, or other attack effect was established.
Mechanism
The helper uses a token and service URL supplied together through local or standard-input configuration for requests to that configured service.
AI rationale
The manifest declares no install-time execution, and the flagged sharp file is an image-processing constructor. The optional helper sends its configured token to its configured service URL; the inspected source does not establish a package-selected recipient or concrete attack.
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json contains only package identity, Windows ARM64 platform metadata, and repository information; it defines no lifecycle hook or JavaScript entrypoint.
- The flagged sharp source constructs an image-processing API from caller-provided input and options, consistent with the bundled image-processing dependency.
- The optional DeepMap helper obtains its service URL and token from explicit configuration and requires both values.
- The helper sends the configured token to requests at the URL formed from that configured service URL.
Evidence against
- The source-similarity flag points to the ordinary sharp image-processing constructor; the inspected excerpt shows no suspicious dynamic execution.
- The package ships a native CLI, and the bounded offline analysis does not establish that its embedded source windows cover all runtime behavior.
Behavioral surface
EvalNetwork
Source & flagged code
9 flaggedbin/event_tracking_rs_bg.mjsView file
2351export function __wbg_new_no_args_ee98eee5275000a4(arg0, arg1) {
L2352: const ret = new Function(getStringFromWasm0(arg0, arg1));
L2353: return ret;
Low
Eval
Package source references a known benign dynamic code generation pattern.
bin/event_tracking_rs_bg.mjsView on unpkg · L2351bin/infcode.exeView file
•path = bin/infcode.exe
kind = native_binary
sizeBytes = 131625984
magicHex = [redacted]
Medium
bin/tree-sitter/tree-sitter-elm.wasmView file
Findings
1 High5 Medium6 Low
HighKnown Malware Source Similaritybin/image-runtime/node_modules/sharp/dist/constructor.cjs
MediumNetwork
MediumShips Native Binarybin/infcode.exe
MediumShips Wasm Modulebin/tree-sitter/tree-sitter-elm.wasm
MediumShips Build Helperbin/deepmap-skill/scripts/deepmap.sh
MediumStructural Risk Force Deep Review
LowEvalbin/event_tracking_rs_bg.mjs
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Dependency Evidencebin/image-runtime/node_modules/sharp/dist/constructor.cjs
LowAi Review Evidencebin/deepmap-skill/scripts/deepmap.sh
LowAi Review Evidencebin/deepmap-skill/scripts/deepmap.sh
Affected versions and remediation
This report applies to @infcode/cli-windows-arm64@2.7.46-dev-65eb4406-42090.
See all versions of @infcode/cli-windows-arm64 for other recorded verdicts.
- Review the evidence and your use of @infcode/cli-windows-arm64@2.7.46-dev-65eb4406-42090 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.