registry / infinicode / 2.8.124

infinicode@2.8.124

OpenKernel — provider-agnostic AI execution kernel. Native coding agent + mission-driven execution runtime.

Static Scan Results

scanned 9h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 125 file(s), 3.93 MB of source, external domains: 100.64.1.2, 100.x.y.z, 127.0.0.1, 192.168.1.12, aistudio.google.com, api.cerebras.ai, api.elevenlabs.io, api.groq.com, api.mistral.ai, api.sambanova.ai, api.telegram.org, build.nvidia.com, chutes.ai, cloud.cerebras.ai, cloud.sambanova.ai, console.groq.com, console.mistral.ai, docs.sglang.ai, docs.vllm.ai, generativelanguage.googleapis.com, github.com, host.docker.internal, html.duckduckgo.com, huggingface.co, integrate.api.nvidia.com, llm.chutes.ai, lmstudio.ai, models.inference.ai.azure.com, ollama.com, opencode.ai, openrouter.ai, registry.npmjs.org, router.huggingface.co, schemas.microsoft.com, www.apple.com

Source & flagged code

4 flagged

dist/robopark/auto-start.jsView file

Lines 1-33javascript

1/**

2 * RoboPark — auto-start registration for production machines.

3 *

4 * Registers the RoboPark service to start on boot:

5 * - Windows → Task Scheduler

6 * - Linux → systemd

7 * - macOS → launchd

8 *

9 * This is used by `robopark setup --auto-start`.

10 */

11import { existsSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

12import { homedir } from 'node:os';

13import { dirname, join } from 'node:path';

14import { spawn, spawnSync } from 'node:child_process';

15function shellQuote(s) {

16 if (!/[^a-zA-Z0-9_./:=,-]/.test(s))

17 return s;

18 return "'" + s.replace(/'/g, "'\\''") + "'";

19}

20export async function registerAutoStart(service) {

21 const platform = process.platform;

22 if (platform === 'win32')

23 return registerWindows(service);

24 if (platform === 'linux')

25 return registerSystemd(service);

26 if (platform === 'darwin')

27 return registerLaunchd(service);

28 return { ok: false, message: `auto-start not supported on ${platform}` };

29}

30async function registerWindows(service) {

31 const taskName = `RoboPark-${service.role}-${service.name}`;

32 const logDir = join(homedir(), 'AppData', 'Roaming', 'robopark', 'logs');

33 mkdirSync(logDir, { recursive: true });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/robopark/auto-start.jsView on unpkg · L13

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/robopark/auto-start.jsView on unpkg · L13

packages/robopark/pi-client/livekit_bridge.pyView file

•path = packages/robopark/pi-client/livekit_bridge.py kind = build_helper sizeBytes = 13349 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/robopark/pi-client/livekit_bridge.pyView on unpkg

dist/robopark/conversation.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = infinicode@2.8.121 matchedIdentity = npm:aW5maW5pY29kZQ:2.8.121 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/robopark/conversation.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code