registry  /  infinicode  /  2.8.18

infinicode@2.8.18

OpenKernel — provider-agnostic AI execution kernel. Native coding agent + mission-driven execution runtime.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 112 file(s), 3.23 MB of source, external domains: 100.64.1.2, 100.x.y.z, 127.0.0.1, aistudio.google.com, api.cerebras.ai, api.groq.com, api.mistral.ai, api.sambanova.ai, api.telegram.org, build.nvidia.com, chutes.ai, cloud.cerebras.ai, cloud.sambanova.ai, console.groq.com, console.mistral.ai, docs.sglang.ai, docs.vllm.ai, generativelanguage.googleapis.com, github.com, html.duckduckgo.com, huggingface.co, integrate.api.nvidia.com, llm.chutes.ai, lmstudio.ai, models.inference.ai.azure.com, opencode.ai, openrouter.ai, router.huggingface.co, schemas.microsoft.com, www.apple.com

Source & flagged code

4 flagged · loading source
dist/robopark/auto-start.jsView file
13import { dirname, join } from 'node:path'; L14: import { spawn } from 'node:child_process'; L15: function shellQuote(s) { ... L20: export async function registerAutoStart(service) { L21: const platform = process.platform; L22: if (platform === 'win32') ... L31: const taskName = `RoboPark-${service.role}-${service.name}`; L32: const logDir = join(homedir(), 'AppData', 'Roaming', 'robopark', 'logs'); L33: mkdirSync(logDir, { recursive: true }); ... L39: mkdirSync(dirname(xmlPath), { recursive: true }); L40: const xml = `<?xml version="1.0" encoding="UTF-16"?>\n<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">\n <RegistrationInfo>\n <Description>Rob... L41: // schtasks /XML requires UTF-16 LE *with* BOM when the XML declares UTF-16.
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/robopark/auto-start.jsView on unpkg · L13
13import { dirname, join } from 'node:path'; L14: import { spawn } from 'node:child_process'; L15: function shellQuote(s) { ... L20: export async function registerAutoStart(service) { L21: const platform = process.platform; L22: if (platform === 'win32') ... L31: const taskName = `RoboPark-${service.role}-${service.name}`; L32: const logDir = join(homedir(), 'AppData', 'Roaming', 'robopark', 'logs'); L33: mkdirSync(logDir, { recursive: true }); ... L39: mkdirSync(dirname(xmlPath), { recursive: true }); L40: const xml = `<?xml version="1.0" encoding="UTF-16"?>\n<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">\n <RegistrationInfo>\n <Description>Rob... L41: // schtasks /XML requires UTF-16 LE *with* BOM when the XML declares UTF-16.
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/robopark/auto-start.jsView on unpkg · L13
packages/robopark/pi-client/livekit_bridge.pyView file
•path = packages/robopark/pi-client/livekit_bridge.py kind = build_helper sizeBytes = 12793 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/robopark/pi-client/livekit_bridge.pyView on unpkg
dist/robopark/setup.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = infinicode@2.8.17 matchedIdentity = npm:aW5maW5pY29kZQ:2.8.17 similarity = 0.991 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/robopark/setup.jsView on unpkg

Findings

2 High5 Medium5 Low
HighSandbox Evasion Gated Capabilitydist/robopark/auto-start.js
HighPrevious Version Dangerous Deltadist/robopark/setup.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/robopark/auto-start.js
MediumShips Build Helperpackages/robopark/pi-client/livekit_bridge.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings