registry / AI-agent control-surface risk / fraim

fraim

FRAIM CLI - Framework for Rigor-based AI Management (alias for fraim-framework)

This report shows the evidence for fraim@2.0.183. 1 of 90 known versions is blocked or flagged. The newest version, 2.0.356, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is a concrete postinstall chain from remote retrieval to mutation of broad project AI-agent control surfaces. The key guard limits reach but does not make the install-time mutation user-consented.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation runs the postinstall `fraim sync --skip-updates`; activation requires an available FRAIM API key.

Impact

A remote service can influence future AI-agent behavior in the installation workspace and receives the configured API key.

Mechanism

remote content sync followed by AI-agent instruction-file mutation

Policy narrative

Installation invokes `fraim sync` automatically. If FRAIM credentials are present in the environment or local configuration, the package sends the key to its remote registry endpoint, downloads registry content, then writes FRAIM-managed instructions into the current project's AGENTS.md and CLAUDE.md. Those instructions direct AI agents to load and execute FRAIM jobs through MCP tools, creating an unconsented remote-controlled agent workflow during install.

AI rationale

Evidence

package.jsonbin/fraim.jsdist/src/cli/commands/sync.jsdist/src/cli/utils/remote-sync.jsdist/src/cli/utils/agent-adapters.jsdist/src/cli/setup/ide-invocation-surfaces.jsAGENTS.mdCLAUDE.mdfraim/

Network endpoints1

fraim.wellnessatwork.me/api/registry/sync

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.

Evidence for policy risk

package.json postinstall runs `fraim sync` automatically.
dist/src/cli/commands/sync.js uses FRAIM_API_KEY/config then fetches remote registry.
dist/src/cli/utils/remote-sync.js sends API key to remote `/api/registry/sync` and writes returned content.
dist/src/cli/utils/agent-adapters.js runs after sync and writes project AGENTS.md and CLAUDE.md.
Adapter content directs agents to discover and execute remote FRAIM jobs via MCP tools.

Evidence against

No local credential harvesting or arbitrary shell execution was confirmed in inspected paths.
Remote registry paths are validated as inside the workspace FRAIM directory before registry writes.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

15 flagged

package.jsonView file

•scripts.postinstall = node ./bin/fraim.js sync --skip-updates || echo 'FRAIM setup skipped.'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/fraim.js sync --skip-updates || echo 'FRAIM setup skipped.'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/core/utils/git-utils.jsView file

9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier; L10: const child_process_1 = require("child_process"); L11: function extractLocalFolderLabel(rawPath) {

High

Child Process

Package source references child process execution.

dist/src/core/utils/git-utils.jsView on unpkg · L9

bin/fraim.jsView file

10// In production/installed package, code is in dist/ L11: require('../dist/src/cli/fraim.js'); L12: } catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/fraim.jsView on unpkg · L10

dist/src/ai-hub/word-sideload.jsView file

21const os_1 = __importDefault(require("os")); L22: const child_process_1 = require("child_process"); L23: const MANIFEST_GUID = 'd1090951-50cf-4cf2-9d12-b0f8541d265c'; ... L26: path_1.default.resolve(projectPath, 'extensions/office-word/manifest.xml'), L27: path_1.default.resolve(__dirname, '..', '..', 'extensions/office-word/manifest.xml'), L28: path_1.default.resolve(__dirname, '..', '..', '..', 'extensions/office-word/manifest.xml'), ... L32: function isSideloaded() { L33: if (process.platform === 'win32') { L34: const result = (0, child_process_1.spawnSync)('reg', [ ... L38: ], { encoding: 'utf8' }); L39: return result.status === 0 && result.stdout.includes(MANIFEST_GUID); L40: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/src/ai-hub/word-sideload.jsView on unpkg · L21

dist/src/cli/doctor/checks/mcp-connectivity-checks.jsView file

53const child_process_1 = require("child_process"); L54: const axios_1 = __importDefault(require("axios")); L55: const toml = __importStar(require("toml")); ... L68: try { L69: const command = process.platform === 'win32' ? (process.env.ComSpec || 'cmd.exe') : 'npm'; L70: const args = process.platform === 'win32' ? ['/d', '/s', '/c', 'npm --version'] : ['--version'];

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/cli/doctor/checks/mcp-connectivity-checks.jsView on unpkg · L53

•matchType = normalized_sha256 matchedPackage = fraim-framework@2.0.185 matchedPath = dist/src/cli/doctor/checks/mcp-connectivity-checks.js matchedIdentity = npm:ZnJhaW0tZnJhbWV3b3Jr:2.0.185 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/doctor/checks/mcp-connectivity-checks.jsView on unpkg

dist/src/cli/commands/override.jsView file

10const chalk_1 = __importDefault(require("chalk")); L11: const axios_1 = __importDefault(require("axios")); L12: const git_utils_1 = require("../../core/utils/git-utils"); ... L20: .action(async (registryPath, options) => { L21: const projectRoot = process.cwd(); L22: const configPath = (0, project_fraim_paths_1.getWorkspaceConfigPath)(projectRoot); ... L61: if (fs_1.default.existsSync(configPath)) { L62: config = JSON.parse(fs_1.default.readFileSync(configPath, 'utf-8')); L63: } ... L65: if (isLocal) { L66: const localPort = process.env.FRAIM_MCP_PORT ? parseInt(process.env.FRAIM_MCP_PORT) : (0, git_utils_1.getPort)(); L67: serverUrl = `http://localhost:${localPort}`;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/cli/commands/override.jsView on unpkg · L10

dist/src/cli/commands/add-ide.jsView file

Lines 128-168javascript

128 return await (0, provider_prompts_1.promptForProviderToken)(client, providerId);

129 }

130 catch (error) {

131 if (isOptional) {

132 console.log(chalk_1.default.blue(`ℹ️ No ${provider

dist/src/first-run/session-service.jsView file

43Trigger-reachable persistence chain: scripts.postinstall -> bin/fraim.js -> dist/src/cli/fraim.js -> dist/src/cli/commands/setup.js -> dist/src/first-run/session-service.js L43: const crypto_1 = __importDefault(require("crypto")); L44: const child_process_1 = require("child_process"); L45: const ide_detector_1 = require("../cli/setup/ide-detector"); ... L54: function getFakeStateMode() { L55: if (process.env.FRAIM_FIRST_RUN_FAKE !== '1') L56: return null; ... L63: function commandVersion(command, extraBinDirs) { L64: const executable = process.platform === 'win32' ? 'cmd.exe' : command; L65: const args = process.platform === 'win32' ... L80: return null; L81: const text = `${result.stdout || ''}${result.stderr || ''}`.split(/\r?\n/)[0]?.trim() || null; L82: return text;

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/src/first-run/session-service.jsView on unpkg · L43

dist/src/cli/setup/user-level-sync.jsView file

95try { L96: (0, child_process_1.execSync)('npm install --no-audit --no-fund --no-save --no-package-lock --omit=dev', { L97: cwd: baseDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/setup/user-level-sync.jsView on unpkg · L95

dist/src/ai-hub/managed-browser.jsView file

•matchType = normalized_sha256 matchedPackage = fraim-framework@2.0.185 matchedPath = dist/src/ai-hub/managed-browser.js matchedIdentity = npm:ZnJhaW0tZnJhbWV3b3Jr:2.0.185 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/ai-hub/managed-browser.jsView on unpkg

dist/src/cli/commands/add-provider.jsView file

•matchType = normalized_sha256 matchedPackage = fraim-framework@2.0.185 matchedPath = dist/src/cli/commands/add-provider.js matchedIdentity = npm:ZnJhaW0tZnJhbWV3b3Jr:2.0.185 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/add-provider.jsView on unpkg

dist/src/cli/commands/first-run.jsView file

•matchType = normalized_sha256 matchedPackage = fraim-framework@2.0.185 matchedPath = dist/src/cli/commands/first-run.js matchedIdentity = npm:ZnJhaW0tZnJhbWV3b3Jr:2.0.185 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/first-run.jsView on unpkg

dist/src/cli/commands/hub.jsView file

•matchType = normalized_sha256 matchedPackage = fraim-framework@2.0.185 matchedPath = dist/src/cli/commands/hub.js matchedIdentity = npm:ZnJhaW0tZnJhbWV3b3Jr:2.0.185 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/hub.jsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/fraim.js sync --skip-updates || echo 'FRAIM setup skipped.'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/fraim.js sync --skip-updates || echo 'FRAIM setup skipped.'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/core/utils/git-utils.jsView file

9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier; L10: const child_process_1 = require("child_process"); L11: function extractLocalFolderLabel(rawPath) {

High

Child Process

Package source references child process execution.

dist/src/core/utils/git-utils.jsView on unpkg · L9

Findings

1 Critical11 High6 Medium5 Low

CriticalAi Agent Control Hijackdist/src/cli/commands/add-ide.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/src/core/utils/git-utils.js

HighSame File Env Network Executiondist/src/cli/doctor/checks/mcp-connectivity-checks.js

HighSandbox Evasion Gated Capabilitydist/src/cli/commands/override.js

HighTrigger Reachable Persistencedist/src/first-run/session-service.js

HighRuntime Package Installdist/src/cli/setup/user-level-sync.js

HighKnown Malware Source Similaritydist/src/cli/doctor/checks/mcp-connectivity-checks.js

HighKnown Malware Source Similaritydist/src/ai-hub/managed-browser.js

HighKnown Malware Source Similaritydist/src/cli/commands/add-provider.js

Affected versions and remediation

This report applies to fraim@2.0.183.

The versions list below shows the verdict for each recorded version.

Avoid installing fraim@2.0.183. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-03 13:43:34.739Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

90 known versions

2.0.356latestUnknown—AllowUnder ReviewOct 22, 2026, 8:36 PM 2.0.355Unknown—AllowUnder ReviewOct 22, 2026, 12:53 AM 2.0.354Unknown—AllowUnder ReviewOct 21, 2026, 7:53 PM 2.0.352SuspiciousAgent extension lifecycle riskWarnPublishedOct 13, 2026, 3:09 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code