registry / @blockrun/franklin / 3.32.0

@blockrun/franklin@3.32.0

⚠ Under review

Franklin Agent — The AI agent with a wallet. Spends USDC autonomously to get real work done. Pay per action, no subscriptions.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 239 file(s), 2.43 MB of source, external domains: 127.0.0.1, 1rpc.io, api.blockrun.ai, api.coingecko.com, api.telegram.org, base.meowrpc.com, base.publicnode.com, basescan.org, blockrun.ai, bridge.polymarket.com, business.blockrun.ai, data-api.polymarket.com, docs.polymarket.com, example.com, fonts.googleapis.com, fonts.gstatic.com, franklin.run, github.com, html.duckduckgo.com, lite-api.jup.ag, mainnet.base.org, nodejs.org, pay.coinbase.com, pm-egress-vbsbhh7lea-an.a.run.app, polygon-rpc.com, polygon.llamarpc.com, polygonscan.com, polymarket.com, registry.npmjs.org, relayer-v2.polymarket.com, sol.blockrun.ai, solscan.io, www.apple.com, www.w3.org, www.youtube.com, x.com

Source & flagged code

4 flagged

dist/plugins/registry.jsView file

Lines 76-116javascript

76 return found;

77}

78// ─── Loading ──────────────────────────────────────────────────────────────

79/** Load a single plugin from its directory */

80export async function loadPlugin(manifest, pluginDir) {

81 // Resolve entry path. Plugin's entry should point to a built JS file.

82 // For bundled plugins, entry might be "dist/index.js" but we ship from src/.

83 // Check both — prefer dist if present.

84 let entryPath = path.join(pluginDir, manifest.entry);

85 if (!fs.existsSync(entryPath)) {

86 // Try .js extension swap (TS source vs built)

87 const jsEntry = entryPath.replace(/\.ts$/, '.js');

88 if (fs.existsSync(jsEntry))

89 entryPath = jsEntry;

90 }

91 if (!fs.existsSync(entryPath)) {

92 process.stderr.write(`[plugin:${manifest.id}] entry not found: ${manifest.entry}\n`);

93 return null;

94 }

95 try {

96 // Dynamic import — works for both ESM and CJS

97 const mod = await import(entryPath);

98 const plugin = mod.default ?? mod.plugin ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/registry.jsView on unpkg · L96

99 if (!plugin || typeof plugin !== 'object') {

100 process.stderr.write(`[plugin:${manifest.id}] invalid plugin export\n`);

101 return null;

102 }

103 // Inject manifest if plugin didn't include it

104 plugin.manifest = manifest;

105 return plugin;

106 }

107 catch (err) {

108 process.stderr.write(`[plugin:${manifest.id}] load failed: ${err.message}\n`);

109 return null;

110 }

111}

112/** Discover and load all plugins. Returns the loaded registry. */

113export async function loadAllPlugins() {

114 if (loaded.size > 0)

115 return loaded;

116 const manifests = discoverPluginManifests();

dist/agent/context.jsView file

Lines 1-26javascript

1/**

2 * Context Manager for Franklin

3 * Assembles system instructions, reads project config, injects environment info.

4 */

5import fs from 'node:fs';

6import path from 'node:path';

7import { execSync } from 'node:child_process';

8import { BLOCKRUN_DIR }

dist/agent/commands.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @blockrun/franklin@3.31.0 matchedIdentity = npm:QGJsb2NrcnVuL2ZyYW5rbGlu:3.31.0 similarity = 0.925 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agent/commands.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/plugins/registry.jsView file

96// Dynamic import — works for both ESM and CJS L97: const mod = await import(entryPath); L98: const plugin = mod.default ?? mod.plugin ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/registry.jsView on unpkg · L96

dist/agent/context.jsView file

6import path from 'node:path'; L7: import { execSync } from 'node:child_process'; L8: import { BLOCKRUN_DIR } from '../config.js'; ... L95: L96: **No internal-language leakage.** Always write your visible response in the same language the user is using. If your private reasoning happens in a different language than the user... L97: ... L146: 2. If SearchX returns empty, tell the user "No posts found" and suggest a different keyword. Do NOT fall back to WebSearch/WebFetch — they will return non-X content that you must N... L147: 3. NEVER fabricate X post URLs. Every link you show MUST come from SearchX results. If a URL doesn't start with "https://x.com/", do NOT present it as an X post. L148: 4. Present results as a numbered list. Each item: author, snippet, URL from SearchX, and a 1-2 sentence suggested reply. ... L197: - Chain selection: ~/.blockrun/payment-chain ("base" or "solana"). Legacy file ~/.blockrun/.chain may also exist on installs that haven't migrated; canonical is payment-chain. L198: - Spending data: L199: - ~/.blockrun/franklin-stats.json — rolling totals + per-model breakdown (what \`franklin stats\` reads).

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/agent/context.jsView on unpkg · L6

6Trigger-reachable chain: manifest.exports -> dist/index.js -> dist/commands/telegram.js -> dist/agent/context.js L6: import path from 'node:path'; L7: import { execSync } from 'node:child_process'; L8: import { BLOCKRUN_DIR } from '../config.js'; ... L95: L96: **No internal-language leakage.** Always write your visible response in the same language the user is using. If your private reasoning happens in a different language than the user... L97: ... L146: 2. If SearchX returns empty, tell the user "No posts found" and suggest a different keyword. Do NOT fall back to WebSearch/WebFetch — they will return non-X content that you must N... L147: 3. NEVER fabricate X post URLs. Every link you show MUST come from SearchX results. If a URL doesn't start with "https://x.com/", do NOT present it as an X post. L148: 4. Present results as a numbered list. Each item: author, snippet, URL from SearchX, and a 1-2 sentence suggested reply. ... L197: - Chain selection: ~/.blockrun/payment-chain ("base" or "solana"). Legacy file ~/.blockrun/.chain may also exist on installs that haven't migrated; canonical is payment-chain. L198: - Spending data: L199: - ~/.blockrun/franklin-stats.json — rolling…

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/agent/context.jsView on unpkg · L6

dist/agent/commands.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agent/commands.jsView on unpkg

Findings

3 Critical4 Medium4 Low

CriticalWallet Draindist/agent/context.js

CriticalTrigger Reachable Dangerous Capabilitydist/agent/context.js

CriticalPrevious Version Dangerous Deltadist/agent/commands.js

MediumDynamic Requiredist/plugins/registry.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/plugins/registry.jsView file

Lines 76-116javascript

76 return found;

77}

79/** Load a single plugin from its directory */

80export async function loadPlugin(manifest, pluginDir) {

81 // Resolve entry path. Plugin's entry should point to a built JS file.

82 // For bundled plugins, entry might be "dist/index.js" but we ship from src/.

83 // Check both — prefer dist if present.

84 let entryPath = path.join(pluginDir, manifest.entry);

85 if (!fs.existsSync(entryPath)) {

86 // Try .js extension swap (TS source vs built)

87 const jsEntry = entryPath.replace(/\.ts$/, '.js');

88 if (fs.existsSync(jsEntry))

89 entryPath = jsEntry;

90 }

91 if (!fs.existsSync(entryPath)) {

92 process.stderr.write(`[plugin:${manifest.id}] entry not found: ${manifest.entry}\n`);

93 return null;

94 }

95 try {

96 // Dynamic import — works for both ESM and CJS

97 const mod = await import(entryPath);

98 const plugin = mod.default ?? mod.plugin ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/registry.jsView on unpkg · L96

99 if (!plugin || typeof plugin !== 'object') {

100 process.stderr.write(`[plugin:${manifest.id}] invalid plugin export\n`);

101 return null;

102 }

103 // Inject manifest if plugin didn't include it

104 plugin.manifest = manifest;

105 return plugin;

106 }

107 catch (err) {

108 process.stderr.write(`[plugin:${manifest.id}] load failed: ${err.message}\n`);

109 return null;

110 }

111}

112/** Discover and load all plugins. Returns the loaded registry. */

113export async function loadAllPlugins() {

114 if (loaded.size > 0)

115 return loaded;

116 const manifests = discoverPluginManifests();

dist/agent/context.jsView file

Lines 1-26javascript

1/**

2 * Context Manager for Franklin

3 * Assembles system instructions, reads project config, injects environment info.

4 */

5import fs from 'node:fs';

6import path from 'node:path';

7import { execSync } from 'node:child_process';

8import { BLOCKRUN_DIR }

dist/agent/commands.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agent/commands.jsView on unpkg