w3bs.AccountStart building
PACKAGES / Profullstack

infernet

GPU node CLI and daemon that registers a GPU server with the Infernet Protocol and serves inference jobs.

ThreatCrush · Malware flagged
INSTALLw3bs install infernetprotocol.com/infernet

No w3bs yet? curl -fsSL https://w3bs.org/install.sh | sh

Get started

What to type once it is installed.

  1. w3bs install infernetprotocol.com/infernetInstall infernet and track it for updates
  2. infernet setupInstall Ollama, pull a model, open the firewall and save config
  3. infernet chat "<prompt>"Run local inference, no control plane needed
  4. infernet model listSee which models are pulled
  5. infernet tuiOpen the live node dashboard (q to quit)

Every option: infernet --help · docs ↗

Malware scan

ThreatCrush found code shaped like malware: a hidden payload executed at runtime or secrets sent off the machine. Read the findings before installing. W3BS reviews flagged packages and delists confirmed ones.

Scanned
2026-11-02 22:59 UTC · threatcrush 0.13.30
Files
850 (installer + github.com/InfernetProtocol/infernet-protocol@12e47e2b1fd9)
Findings
6 high · 14 medium · 20 low · 3 malware indicators
  • Malware indicator
    code sink reached indirectlysource/apps/web/lib/operator-vault.js:33js-indirect-code-sink · CWE-506
  • Malware indicator
    code sink reached indirectlysource/apps/web/lib/operator-vault.js:34js-indirect-code-sink · CWE-506
  • Malware indicator
    code sink reached indirectlysource/apps/web/lib/operator-vault.js:38js-indirect-code-sink · CWE-506
37 other findings (not malware)
  • high
    Electron renderer given Node accesssource/apps/desktop/electron/main.js:27js-electron-node-integration · CWE-1188
  • high
    Generic API Keysource/apps/web/app/getting-started/page.js:136secret-generic-api-key · CWE-798
  • high
    Generic API Keysource/docs/book/01-introduction/getting-started.md:40secret-generic-api-key · CWE-798
  • high
    Database URL with credentialssource/docs/MIGRATIONS.md:56secret-database-url · CWE-798
  • high
    Database URL with credentialssource/ipips/ipip-0013.md:187secret-database-url · CWE-798
  • high
    Sensitive filesource/sample.env:1sensitive-file-committed · CWE-538
  • medium
    High-entropy Hex Tokensource/apps/mobile/src/context/AuthContext.js:170secret-hex-token · CWE-798
  • medium
    High-entropy Hex Tokensource/apps/mobile/src/context/AuthContext.js:239secret-hex-token · CWE-798
  • medium
    High-entropy Hex Tokensource/apps/web/app/docs/page.js:293secret-hex-token · CWE-798
  • medium
    unescaped HTML renderingsource/apps/web/app/layout.js:148js-unescaped-html-sink · CWE-79
  • medium
    redirect to a non-constant destinationsource/apps/web/app/order/order-view.js:43js-open-redirect · CWE-601
  • medium
    unescaped HTML renderingsource/apps/web/components/pit-footer.js:30js-unescaped-html-sink · CWE-79
  • medium
    network output piped into a shellsource/install.sh:583sh-remote-script-execution · CWE-494
  • medium
    network output piped into a shellsource/install.sh:721sh-remote-script-execution · CWE-494
  • medium
    network output piped into a shellsource/install.sh:971sh-remote-script-execution · CWE-494
  • medium
    predictable temporary filesource/install.sh:1306sh-predictable-temp-path · CWE-377
  • medium
    regex with nested unbounded quantifierssource/packages/gpu/src/interconnect.js:177redos-nested-quantifier · CWE-1333
  • low
    Hardcoded Credentialsource/docs/book/04-building-apps/index.md:33secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/tests/auth-parse-body.test.js:43secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/tests/auth-parse-body.test.js:46secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/tests/auth-parse-body.test.js:64secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/tests/auth-parse-body.test.js:70secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/tests/auth-parse-body.test.js:73secret-generic-credential · CWE-798
  • low
    High-entropy Hex Tokensource/tests/cli-peers.test.js:51secret-hex-token · CWE-798
  • low
    JSON Web Tokensource/tests/cpr-canary.test.js:26secret-jwt · CWE-798
  • low
    High-entropy Hex Tokensource/tests/cpr-receipts.test.js:179secret-hex-token · CWE-798
  • low
    High-entropy Hex Tokensource/tests/cpr-receipts.test.js:182secret-hex-token · CWE-798
  • low
    Generic API Keysource/tests/deploy-providers-foundation.test.js:220secret-generic-api-key · CWE-798
  • low
    Private Keysource/tests/liquid-agent.test.js:88secret-private-key · CWE-798
  • low
    High-entropy Hex Tokensource/tests/node-commands-auth.test.js:68secret-hex-token · CWE-798
  • low
    High-entropy Hex Tokensource/tests/node-commands-auth.test.js:69secret-hex-token · CWE-798
  • low
    Generic API Keysource/tests/operator-vault.test.js:62secret-generic-api-key · CWE-798
  • low
    Hardcoded Credentialsource/tests/profile-signup.test.js:53secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/tests/profile-signup.test.js:65secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/tests/profile-signup.test.js:90secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/tests/reservation-orders.test.js:152secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/tests/reservations.test.js:263secret-generic-credential · CWE-798

Badge for your README

ThreatCrush: Malware flagged

[![ThreatCrush scan](https://w3bs.org/api/packages/infernetprotocol.com/infernet/badge.svg)](https://w3bs.org/packages/infernetprotocol.com/infernet)