registry / @archymedes/friday / 3.12.7
@archymedes/friday@3.12.7
Friday — a coding agent for your terminal that shows its work, asks before it changes anything, and proves a change works. Any model: ten providers, free models, your Claude subscription or your ChatGPT plan.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged process execution and network behavior fit the package’s stated coding-agent CLI purpose. Its automatic install cue contains only basic version and platform fields, is disclosed in settings, and can be disabled; outcome reporting requires a configured endpoint.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the Friday CLI; the install cue is sent at most once per version unless telemetry is disabled.
Impact
No credential or project-data exfiltration was found in the reviewed flows.
Mechanism
The cue posts event, version, OS, and architecture to https://archymedes.xyz/api/v1/count/. Other outcome reporting requires an explicitly configured endpoint.
AI rationale
The flagged process execution and network behavior fit the package’s stated coding-agent CLI purpose. Its automatic install cue contains only basic version and platform fields, is disclosed in settings, and can be disabled; outcome reporting requires a configured endpoint.
Evidence
settingsDirectory(environment)/installed.json
Network endpoints1
archymedes.xyz/api/v1/count/
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a Friday CLI and uses a non-install-time prepublishOnly build script.
- The launcher starts the platform interface binary or the bundled agent as part of the CLI’s stated purpose.
- The CLI labels its optional install count as one anonymous cue per version and offers telemetry choices.
- The cue sends only an install/update event, version, OS, and architecture; telemetry can be disabled with ARCHYMEDES_TELEMETRY=off or DO_NOT_TRACK.
- Outcome reporting has no destination unless the user configures ARCHYMEDES_OUTCOMES_URL.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggedbin/friday.mjsView file
10// before, and asked for the interface it says why there is none and how to get it.
L11: import { spawn } from "node:child_process";
L12: import { existsSync } from "node:fs";
High
16L17: const require = createRequire(import.meta.url);
L18: const agentEntry = path.join(import.meta.dirname, "..", "dist", "friday.mjs");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/friday.mjsView on unpkg · L16dist/archymedes-main.mjsView file
3006"pwsh",
L3007: "powershell",
L3008: "cmd",
High
Findings
9 High4 Medium6 Low
HighChild Processbin/friday.mjs
HighShelldist/archymedes-main.mjs
HighSame File Env Network Executiondist/archymedes-main.mjs
HighCommand Output Exfiltrationdist/archymedes-main.mjs
HighCloud Metadata Accessdist/archymedes-main.mjs
HighRemote Agent Bridgedist/archymedes-main.mjs
HighCross File Remote Execution Contextdist/archymedes-main.mjs
HighBase64 Obscured Urldist/factory-6kd0ywyr.mjs
HighSemantic Analysis Limiteddist/archymedes-main.mjs
MediumDynamic Requirebin/friday.mjs
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @archymedes/friday@3.12.7.
See all versions of @archymedes/friday for other recorded verdicts.
- Review the evidence and your use of @archymedes/friday@3.12.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.