registry / infinicode / 2.8.61

infinicode@2.8.61

OpenKernel — provider-agnostic AI execution kernel. Native coding agent + mission-driven execution runtime.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 121 file(s), 3.59 MB of source, external domains: 100.64.1.2, 100.x.y.z, 127.0.0.1, 192.168.1.12, aistudio.google.com, api.cerebras.ai, api.groq.com, api.mistral.ai, api.sambanova.ai, api.telegram.org, build.nvidia.com, chutes.ai, cloud.cerebras.ai, cloud.sambanova.ai, console.groq.com, console.mistral.ai, docs.sglang.ai, docs.vllm.ai, generativelanguage.googleapis.com, github.com, html.duckduckgo.com, huggingface.co, integrate.api.nvidia.com, llm.chutes.ai, lmstudio.ai, models.inference.ai.azure.com, ollama.com, opencode.ai, openrouter.ai, registry.npmjs.org, router.huggingface.co, schemas.microsoft.com, www.apple.com

Source & flagged code

7 flagged

dist/robopark/auto-start.jsView file

Lines 1-56javascript

1/**

2 * RoboPark — auto-start registration for production machines.

3 *

4 * Registers the RoboPark service to start on boot:

5 * - Windows → Task Scheduler

6 * - Linux → systemd

7 * - macOS → launchd

8 *

9 * This is used by `robopark setup --auto-start`.

10 */

11import { existsSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

12import { homedir } from 'node:os';

13import { dirname, join } from 'node:path';

14import { spawn, spawnSync } from 'node:child_process';

15function shellQuote(s) {

High

Child Process

Package source references child process execution.

dist/robopark/auto-start.jsView on unpkg · L13

16 if (!/[^a-zA-Z0-9_./:=,-]/.test(s))

17 return s;

18 return "'" + s.replace(/'/g, "'\\''") + "'";

19}

20export async function registerAutoStart(service) {

21 const platform = process.platform;

22 if (platform === 'win32')

23 return registerWindows(service);

24 if (platform === 'linux')

25 return registerSystemd(service);

26 if (platform === 'darwin')

27 return registerLaunchd(service);

28 return { ok: false, message: `auto-start not supported on ${platform}` };

29}

30async function registerWindows(service) {

31 const taskName = `RoboPark-${service.role}-${service.name}`;

32 const logDir = join(homedir(), 'AppData', 'Roaming', 'robopark', 'logs');

33 mkdirSync(logDir, { recursive: true });

34 const outLog = join(logDir, `${taskName}.log`);

35 const errLog = join(logDir, `${taskName}.err.log`);

36 const script = [service.command, ...service.args].map(shellQuote).join(' ');

37 const cmd = ['powershell.exe', '-WindowStyle', 'Hidden', '-ExecutionPolicy', 'Bypass', '-Command', script];

38 const xmlPath = join(homedir(), 'AppData', 'Roaming', 'robopark', `${taskName}.xml`);

High

Shell

Package source references shell execution.

dist/robopark/auto-start.jsView on unpkg · L36

39 mkdirSync(dirname(xmlPath), { recursive: true });

40 const xml = `<?xml version="1.0" encoding="UTF-16"?>\n<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">\n <RegistrationInfo>\n <Description>RoboPark ${service.role} for ${service.name}</Description>\n </RegistrationInfo>\n <Triggers>\n <BootTrigger>\n <Enabled>true</Enabled>\n </BootTrigger>\n <LogonTrigger>\n <Enabled>true</Enabled>\n </LogonTrigger>\n </Triggers>\n <Principals>\n <Principal id="Author">\n

41 // schtasks /XML requires UTF-16 LE *with* BOM when the XML declares UTF-16.

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/robopark/auto-start.jsView on unpkg · L13

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/robopark/auto-start.jsView on unpkg · L13

42 const bom = Buffer.from([0xff, 0xfe]);

43 const body = Buffer.from(xml, 'utf16le');

44 writeFileSync(xmlPath, Buffer.concat([bom, body]));

45 return new Promise((resolve) => {

46 const schtasks = spawn('schtasks', ['/Create', '/TN', taskName, '/XML', xmlPath, '/F'], { stdio: 'pipe' });

47 let out = '';

48 let err = '';

49 schtasks.stdout.on('data', d => (out += d.toString()));

50 schtasks.stderr.on('data', d => (err += d.toString()));

51 schtasks.on('close', code => {

52 if (code === 0) {

53 resolve({ ok: true, message: `registered Windows Task Scheduler task "${taskName}"` });

54 }

55 else {

56 resolve({ ok: false, message: `schtasks failed (${code}): ${err || out}` });

Long lines were clipped for display.

dist/robopark/robot-runtime.jsView file

Lines 95-135javascript

95 command: process.execPath,

96 args: [cli, 'vision-agent', '--foreground', '--port', '5000',

97 '--motion-webhook-url', 'http://127.0.0.1:5057/'],

98 });

99 }

100 const previewArgs = [cli,

packages/robopark/pi-client/livekit_bridge.pyView file

•path = packages/robopark/pi-client/livekit_bridge.py kind = build_helper sizeBytes = 13349 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/robopark/pi-client/livekit_bridge.pyView on unpkg

Source & flagged code

7 flagged · loading source

dist/robopark/auto-start.jsView file

13import { dirname, join } from 'node:path'; L14: import { spawn, spawnSync } from 'node:child_process'; L15: function shellQuote(s) {

High

Child Process

Package source references child process execution.

dist/robopark/auto-start.jsView on unpkg · L13

36const script = [service.command, ...service.args].map(shellQuote).join(' '); L37: const cmd = ['powershell.exe', '-WindowStyle', 'Hidden', '-ExecutionPolicy', 'Bypass', '-Command', script]; L38: const xmlPath = join(homedir(), 'AppData', 'Roaming', 'robopark', `${taskName}.xml`);

High

Shell

Package source references shell execution.

dist/robopark/auto-start.jsView on unpkg · L36

13import { dirname, join } from 'node:path'; L14: import { spawn, spawnSync } from 'node:child_process'; L15: function shellQuote(s) { ... L20: export async function registerAutoStart(service) { L21: const platform = process.platform; L22: if (platform === 'win32') ... L31: const taskName = `RoboPark-${service.role}-${service.name}`; L32: const logDir = join(homedir(), 'AppData', 'Roaming', 'robopark', 'logs'); L33: mkdirSync(logDir, { recursive: true }); ... L39: mkdirSync(dirname(xmlPath), { recursive: true }); L40: const xml = `<?xml version="1.0" encoding="UTF-16"?>\n<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">\n <RegistrationInfo>\n <Description>Rob... L41: // schtasks /XML requires UTF-16 LE *with* BOM when the XML declares UTF-16.

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/robopark/auto-start.jsView on unpkg · L13

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/robopark/auto-start.jsView on unpkg · L13

dist/robopark/robot-runtime.jsView file

115// This also lets preview start while RoboVision is still warming up. L116: ROBOVISION_URL: opts.vision !== false ? 'http://127.0.0.1:5000' : '', L117: ROBOVISION_MEDIA_URL: opts.vision !== false ... L125: const start = (entry) => { L126: const child = spawn(entry.command, entry.args, { L127: env: { ...process.env, ...entry.env, ROBOPARK_ROBOT_RUNTIME: '1' }, L128: stdio: runtimeLog(`robot-${opts.name}-${entry.label}`, foreground),

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/robopark/robot-runtime.jsView on unpkg · L115

•matchType = previous_version_dangerous_delta matchedPackage = infinicode@2.8.60 matchedIdentity = npm:aW5maW5pY29kZQ:2.8.60 similarity = 0.974 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/robopark/robot-runtime.jsView on unpkg

packages/robopark/pi-client/livekit_bridge.pyView file

•path = packages/robopark/pi-client/livekit_bridge.py kind = build_helper sizeBytes = 13349 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/robopark/pi-client/livekit_bridge.pyView on unpkg

Findings

5 High5 Medium5 Low

HighChild Processdist/robopark/auto-start.js

HighShelldist/robopark/auto-start.js

HighSame File Env Network Executiondist/robopark/robot-runtime.js

HighSandbox Evasion Gated Capabilitydist/robopark/auto-start.js

HighPrevious Version Dangerous Deltadist/robopark/robot-runtime.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/robopark/auto-start.js

MediumShips Build Helperpackages/robopark/pi-client/livekit_bridge.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/robopark/auto-start.jsView file

Lines 1-56javascript

1/**

2 * RoboPark — auto-start registration for production machines.

3 *

4 * Registers the RoboPark service to start on boot:

5 * - Windows → Task Scheduler

6 * - Linux → systemd

7 * - macOS → launchd

8 *

9 * This is used by `robopark setup --auto-start`.

10 */

11import { existsSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

12import { homedir } from 'node:os';

13import { dirname, join } from 'node:path';

14import { spawn, spawnSync } from 'node:child_process';

15function shellQuote(s) {

High

Child Process

Package source references child process execution.

dist/robopark/auto-start.jsView on unpkg · L13

16 if (!/[^a-zA-Z0-9_./:=,-]/.test(s))

17 return s;

18 return "'" + s.replace(/'/g, "'\\''") + "'";

19}

20export async function registerAutoStart(service) {

21 const platform = process.platform;

22 if (platform === 'win32')

23 return registerWindows(service);

24 if (platform === 'linux')

25 return registerSystemd(service);

26 if (platform === 'darwin')

27 return registerLaunchd(service);

28 return { ok: false, message: `auto-start not supported on ${platform}` };

29}

30async function registerWindows(service) {

31 const taskName = `RoboPark-${service.role}-${service.name}`;

32 const logDir = join(homedir(), 'AppData', 'Roaming', 'robopark', 'logs');

33 mkdirSync(logDir, { recursive: true });

34 const outLog = join(logDir, `${taskName}.log`);

35 const errLog = join(logDir, `${taskName}.err.log`);

36 const script = [service.command, ...service.args].map(shellQuote).join(' ');

37 const cmd = ['powershell.exe', '-WindowStyle', 'Hidden', '-ExecutionPolicy', 'Bypass', '-Command', script];

38 const xmlPath = join(homedir(), 'AppData', 'Roaming', 'robopark', `${taskName}.xml`);

High

Shell

Package source references shell execution.

dist/robopark/auto-start.jsView on unpkg · L36

39 mkdirSync(dirname(xmlPath), { recursive: true });

41 // schtasks /XML requires UTF-16 LE *with* BOM when the XML declares UTF-16.

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/robopark/auto-start.jsView on unpkg · L13

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/robopark/auto-start.jsView on unpkg · L13

42 const bom = Buffer.from([0xff, 0xfe]);

43 const body = Buffer.from(xml, 'utf16le');

44 writeFileSync(xmlPath, Buffer.concat([bom, body]));

45 return new Promise((resolve) => {

46 const schtasks = spawn('schtasks', ['/Create', '/TN', taskName, '/XML', xmlPath, '/F'], { stdio: 'pipe' });

47 let out = '';

48 let err = '';

49 schtasks.stdout.on('data', d => (out += d.toString()));

50 schtasks.stderr.on('data', d => (err += d.toString()));

51 schtasks.on('close', code => {

52 if (code === 0) {

53 resolve({ ok: true, message: `registered Windows Task Scheduler task "${taskName}"` });

54 }

55 else {

56 resolve({ ok: false, message: `schtasks failed (${code}): ${err || out}` });

Long lines were clipped for display.

dist/robopark/robot-runtime.jsView file

Lines 95-135javascript

95 command: process.execPath,

96 args: [cli, 'vision-agent', '--foreground', '--port', '5000',

97 '--motion-webhook-url', 'http://127.0.0.1:5057/'],

98 });

99 }

100 const previewArgs = [cli,

packages/robopark/pi-client/livekit_bridge.pyView file

•path = packages/robopark/pi-client/livekit_bridge.py kind = build_helper sizeBytes = 13349 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/robopark/pi-client/livekit_bridge.pyView on unpkg