registry / @infernetprotocol/cli / 0.1.49

@infernetprotocol/cli@0.1.49

GPU-node CLI / daemon for the Infernet Protocol — register a GPU server with a Supabase control plane and start earning.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 55 file(s), 491 KB of source, external domains: 10.0.0.1, 10.0.0.7, 127.0.0.1, 192.168.0.1, 192.168.1.1, api.github.com, api.ipify.org, api.valueserp.com, cloud.vast.ai, github.com, huggingface.co, icanhazip.com, ifconfig.me, infernetprotocol.com, nodejs.org, ollama.com, rocm.docs.amd.com, www.nvidia.com, www.runpod.io, your-bucket.s3.amazonaws.com

Source & flagged code

5 flagged

lib/daemonize.jsView file

Lines 1-26javascript

1/**

2 * Daemonize helper — re-spawns the current CLI as a detached background

3 * process running `infernet start --foreground`, with stdout/stderr piped

4 * to the daemon log file.

5 */

7import { spawn } from 'node:child_process';

8import fs from 'node:fs';

High

Child Process

Package source references child process execution.

lib/daemonize.jsView on unpkg · L6

9import path from 'node:path';

11import { getConfigDir, getDaemonLogPath } from './config.js';

13/**

14 * @param {string[]} passthroughArgs Extra args to hand to the foreground start

15 * (e.g. --heartbeat-interval, --poll-interval).

16 * @returns {{ pid: number, logPath: string }}

17 */

18export function spawnDetachedDaemon(passthroughArgs = []) {

19 fs.mkdirSync(getConfigDir(), { recursive: true, mode: 0o700 });

21 const logPath = getDaemonLogPath();

22 const out = fs.openSync(logPath, 'a');

23 const err = fs.openSync(logPath, 'a');

25 // process.argv[1] is the CLI entry script (absolute path when invoked

26 // via `node path/to/cli/index.js` or via the bin symlink).

lib/firewall.jsView file

Lines 68-108javascript

68 break;

69 case 'firewalld':

70 lines.push('[firewalld]');

71 lines.push(` sudo firewall-cmd --permanent --add-port=${port}/tcp`);

72 lines.push

lib/vllm.jsView file

Lines 1-36javascript

1/**

2 * vLLM serve manager — turns ON the vLLM backend the installer already put on

3 * the box (venv → `$INFERNET_BIN/vllm`) but that nothing ever started.

4 *

5 * vLLM serves ONE model per GPU process on an OpenAI-compatible API (:8000),

6 * so we run a single model at a time; installing a new `hf:` model replaces

7 * the current one. We track the process in a state file and advertise the

8 * served model (by its `hf:` pull name via `--served-model-name`) so it lands

9 * in `served_models` → shows in /chat, and the engine auto-selects vLLM over

10 * Ollama (per createEngine's precedence) once /v1/models answers.

commands/service.jsView file

Lines 6-46javascript

6 * daemon: auto-restart on crash, optional auto-start at boot, logs

7 * to journald. Runs as the unprivileged user — never touches /etc

commands/start.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @infernetprotocol/cli@0.1.47 matchedIdentity = npm:QGluZmVybmV0cHJvdG9jb2wvY2xp:0.1.47 similarity = 0.964 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

commands/start.jsView on unpkg

Source & flagged code

5 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code