registry / infinicode / 2.8.16

infinicode@2.8.16

OpenKernel — provider-agnostic AI execution kernel. Native coding agent + mission-driven execution runtime.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 112 file(s), 3.23 MB of source, external domains: 100.64.1.2, 100.x.y.z, 127.0.0.1, aistudio.google.com, api.cerebras.ai, api.groq.com, api.mistral.ai, api.sambanova.ai, api.telegram.org, build.nvidia.com, chutes.ai, cloud.cerebras.ai, cloud.sambanova.ai, console.groq.com, console.mistral.ai, docs.sglang.ai, docs.vllm.ai, generativelanguage.googleapis.com, github.com, html.duckduckgo.com, huggingface.co, integrate.api.nvidia.com, llm.chutes.ai, lmstudio.ai, models.inference.ai.azure.com, opencode.ai, openrouter.ai, router.huggingface.co, schemas.microsoft.com, www.apple.com

Source & flagged code

4 flagged

dist/robopark/auto-start.jsView file

Lines 1-33javascript

1/**

2 * RoboPark — auto-start registration for production machines.

3 *

4 * Registers the RoboPark service to start on boot:

5 * - Windows → Task Scheduler

6 * - Linux → systemd

7 * - macOS → launchd

8 *

9 * This is used by `robopark setup --auto-start`.

10 */

11import { writeFileSync, mkdirSync } from 'node:fs';

12import { homedir } from 'node:os';

13import { dirname, join } from 'node:path';

14import { spawn } from 'node:child_process';

15function shellQuote(s) {

16 if (!/[^a-zA-Z0-9_./:=,-]/.test(s))

17 return s;

18 return "'" + s.replace(/'/g, "'\\''") + "'";

19}

20export async function registerAutoStart(service) {

21 const platform = process.platform;

22 if (platform === 'win32')

23 return registerWindows(service);

24 if (platform === 'linux')

25 return registerSystemd(service);

26 if (platform === 'darwin')

27 return registerLaunchd(service);

28 return { ok: false, message: `auto-start not supported on ${platform}` };

29}

30async function registerWindows(service) {

31 const taskName = `RoboPark-${service.role}-${service.name}`;

32 const logDir = join(homedir(), 'AppData', 'Roaming', 'robopark', 'logs');

33 mkdirSync(logDir, { recursive: true });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/robopark/auto-start.jsView on unpkg · L13

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/robopark/auto-start.jsView on unpkg · L13

packages/robopark/pi-client/livekit_bridge.pyView file

•path = packages/robopark/pi-client/livekit_bridge.py kind = build_helper sizeBytes = 12793 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/robopark/pi-client/livekit_bridge.pyView on unpkg

dist/robopark/probe.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = infinicode@2.8.8 matchedIdentity = npm:aW5maW5pY29kZQ:2.8.8 similarity = 0.960 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/robopark/probe.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/robopark/auto-start.jsView file

13import { dirname, join } from 'node:path'; L14: import { spawn } from 'node:child_process'; L15: function shellQuote(s) { ... L20: export async function registerAutoStart(service) { L21: const platform = process.platform; L22: if (platform === 'win32') ... L31: const taskName = `RoboPark-${service.role}-${service.name}`; L32: const logDir = join(homedir(), 'AppData', 'Roaming', 'robopark', 'logs'); L33: mkdirSync(logDir, { recursive: true }); ... L39: mkdirSync(dirname(xmlPath), { recursive: true }); L40: const xml = `<?xml version="1.0" encoding="UTF-16"?>\n<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">\n <RegistrationInfo>\n <Description>Rob... L41: // schtasks /XML requires UTF-16 LE *with* BOM when the XML declares UTF-16.

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/robopark/auto-start.jsView on unpkg · L13

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/robopark/auto-start.jsView on unpkg · L13

packages/robopark/pi-client/livekit_bridge.pyView file

•path = packages/robopark/pi-client/livekit_bridge.py kind = build_helper sizeBytes = 12793 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/robopark/pi-client/livekit_bridge.pyView on unpkg

dist/robopark/probe.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/robopark/probe.jsView on unpkg

Findings

2 High5 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/robopark/auto-start.js

HighPrevious Version Dangerous Deltadist/robopark/probe.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/robopark/auto-start.js

MediumShips Build Helperpackages/robopark/pi-client/livekit_bridge.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/robopark/auto-start.jsView file

Lines 1-33javascript

1/**

2 * RoboPark — auto-start registration for production machines.

3 *

4 * Registers the RoboPark service to start on boot:

5 * - Windows → Task Scheduler

6 * - Linux → systemd

7 * - macOS → launchd

8 *

9 * This is used by `robopark setup --auto-start`.

10 */

11import { writeFileSync, mkdirSync } from 'node:fs';

12import { homedir } from 'node:os';

13import { dirname, join } from 'node:path';

14import { spawn } from 'node:child_process';

15function shellQuote(s) {

16 if (!/[^a-zA-Z0-9_./:=,-]/.test(s))

17 return s;

18 return "'" + s.replace(/'/g, "'\\''") + "'";

19}

20export async function registerAutoStart(service) {

21 const platform = process.platform;

22 if (platform === 'win32')

23 return registerWindows(service);

24 if (platform === 'linux')

25 return registerSystemd(service);

26 if (platform === 'darwin')

27 return registerLaunchd(service);

28 return { ok: false, message: `auto-start not supported on ${platform}` };

29}

30async function registerWindows(service) {

31 const taskName = `RoboPark-${service.role}-${service.name}`;

32 const logDir = join(homedir(), 'AppData', 'Roaming', 'robopark', 'logs');

33 mkdirSync(logDir, { recursive: true });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/robopark/auto-start.jsView on unpkg · L13

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/robopark/auto-start.jsView on unpkg · L13

packages/robopark/pi-client/livekit_bridge.pyView file

•path = packages/robopark/pi-client/livekit_bridge.py kind = build_helper sizeBytes = 12793 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/robopark/pi-client/livekit_bridge.pyView on unpkg

dist/robopark/probe.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/robopark/probe.jsView on unpkg