@infcode/cli-windows-x64@1.0.2
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package contains no install hook or malicious credential-exfiltration behavior, but its CLI records runtime metrics automatically with account-associated identifiers and no consent check visible in that recording path. Treat this as suspicious telemetry and warn rather than block.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Starting the CLI; resource sampling starts during startup and the first-start event is reported when applicable.
Impact
Usage and account-associated identifiers may be sent without a consent check visible in the recording path; the reviewed source does not show credentials being transmitted.
Mechanism
Metrics events are queued for the configured auth base URL or the default tokensinfinity.com service. Event fields can include device/account and session dimensions, plus metrics metadata.
AI rationale
The package contains no install hook or malicious credential-exfiltration behavior, but its CLI records runtime metrics automatically with account-associated identifiers and no consent check visible in that recording path. Treat this as suspicious telemetry and warn rather than block.
Evidence
bin/infcode.mapbin/chunk-k5qjeay6.js.mapGlobal.Path.data/telemetry-idAuthStorage.dir()/metrics/first-install.json
Network endpoints2
www.tokensinfinity.comINFCODE_EVENT_TRACKING_ENDPOINT (configurable)
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The manifest contains only package identity and Windows x64 platform metadata; it declares no lifecycle scripts, bin, main, or exports.
- CLI startup starts resource sampling and reports a first-start metrics event without a separate user command.
- The metrics recorder accepts events unless disabled or shutting down; event construction can attach user, session, tenant, and department IDs, as well as metadata.
- Metrics go to the configured auth base URL or default to https://www.tokensinfinity.com.
- The metrics sanitizer redacts bearer tokens, API keys, auth tokens, and email addresses from detail text.
Evidence against
- The package has no install-time scripts, so installing this platform package does not itself trigger the reviewed runtime telemetry.
- The default metrics host is the product service, and the source includes sanitization for sensitive strings in event details.
Behavioral surface
EvalNetwork
Source & flagged code
9 flaggedbin/event_tracking_rs_bg.mjsView file
2351export function __wbg_new_no_args_ee98eee5275000a4(arg0, arg1) {
L2352: const ret = new Function(getStringFromWasm0(arg0, arg1));
L2353: return ret;
Low
Eval
Package source references a known benign dynamic code generation pattern.
bin/event_tracking_rs_bg.mjsView on unpkg · L2351bin/rg-win7.exeView file
•path = bin/rg-win7.exe
kind = native_binary
sizeBytes = 5407744
magicHex = [redacted]
Medium
bin/tree-sitter/tree-sitter-elm.wasmView file
Findings
1 High9 Medium2 Low
HighKnown Malware Source Similaritybin/image-runtime/node_modules/sharp/dist/constructor.cjs
MediumNetwork
MediumShips Native Binarybin/rg-win7.exe
MediumShips Wasm Modulebin/tree-sitter/tree-sitter-elm.wasm
MediumShips Build Helperbin/deepmap-skill/scripts/deepmap.sh
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencebin/infcode.map
MediumAi Review Evidencebin/infcode.map
MediumAi Review Evidencebin/chunk-k5qjeay6.js.map
LowEvalbin/event_tracking_rs_bg.mjs
LowNo License
Affected versions and remediation
This report applies to @infcode/cli-windows-x64@1.0.2.
See all versions of @infcode/cli-windows-x64 for other recorded verdicts.
- Review the evidence and your use of @infcode/cli-windows-x64@1.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.