fraim: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

fraim: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

11 flagged · loading source

dist/src/core/utils/git-utils.jsView file

9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier; L10: const child_process_1 = require("child_process"); L11: function extractLocalFolderLabel(rawPath) {

High

Child Process

Package source references child process execution.

dist/src/core/utils/git-utils.jsView on unpkg · L9

bin/fraim.jsView file

3try { L4: require('../dist/src/cli/fraim.js'); L5: } catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/fraim.jsView on unpkg · L3

dist/src/first-run/session-service.jsView file

44Trigger-reachable persistence chain: manifest.bin -> bin/fraim.js -> dist/src/cli/fraim.js -> dist/src/cli/commands/setup.js -> dist/src/first-run/session-service.js L44: const crypto_1 = __importDefault(require("crypto")); L45: const child_process_1 = require("child_process"); L46: const ide_detector_1 = require("../cli/setup/ide-detector"); ... L55: function getFakeStateMode() { L56: if (process.env.FRAIM_FIRST_RUN_FAKE !== '1') L57: return null; ... L64: function commandVersion(command, extraBinDirs, basePath) { L65: const executable = process.platform === 'win32' ? 'cmd.exe' : command; L66: const args = process.platform === 'win32' ... L79: return null; L80: const text = `${result.stdout || ''}${result.stderr || ''}`.split(/\r?\n/)[0]?.trim() || null; L81: return text;

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/src/first-run/session-service.jsView on unpkg · L44

44const crypto_1 = __importDefault(require("crypto")); L45: const child_process_1 = require("child_process"); L46: const ide_detector_1 = require("../cli/setup/ide-detector"); ... L55: function getFakeStateMode() { L56: if (process.env.FRAIM_FIRST_RUN_FAKE !== '1') L57: return null; ... L64: function commandVersion(command, extraBinDirs, basePath) { L65: const executable = process.platform === 'win32' ? 'cmd.exe' : command; L66: const args = process.platform === 'win32' ... L79: return null; L80: const text = `${result.stdout || ''}${result.stderr || ''}`.split(/\r?\n/)[0]?.trim() || null; L81: return text;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/src/first-run/session-service.jsView on unpkg · L44

dist/src/cli/doctor/checks/scripts-checks.jsView file

14const os_1 = __importDefault(require("os")); L15: const child_process_1 = require("child_process"); L16: const SCRIPTS_DIR = path_1.default.join(os_1.default.homedir(), '.fraim', 'scripts'); L17: /** ... L92: // Skip on Windows L93: if (process.platform === 'win32') { L94: return { ... L172: if (pyResult.status === 0) { L173: const version = (pyResult.stdout || pyResult.stderr || '').trim(); L174: return { ... L191: message: 'Python not available on Windows — Microsoft Store alias detected or Python not installed', L192: suggestion: 'Install Python from https://www.python.org/downloads/windows/ (the official installer registers the py launcher). Python scripts in ~/.fraim/scripts/ will not run unti...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/cli/doctor/checks/scripts-checks.jsView on unpkg · L14

dist/src/cli/setup/user-level-sync.jsView file

95try { L96: (0, child_process_1.execSync)('npm install --no-audit --no-fund --no-save --no-package-lock --omit=dev', { L97: cwd: baseDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/setup/user-level-sync.jsView on unpkg · L95

•matchType = normalized_sha256 matchedPackage = fraim@2.0.183 matchedPath = dist/src/cli/setup/user-level-sync.js matchedIdentity = npm:ZnJhaW0:2.0.183 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/setup/user-level-sync.jsView on unpkg

index.jsView file

•matchType = normalized_sha256 matchedPackage = fraim@2.0.183 matchedPath = index.js matchedIdentity = npm:ZnJhaW0:2.0.183 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

dist/src/cli/commands/override.jsView file

•matchType = normalized_sha256 matchedPackage = fraim@2.0.183 matchedPath = dist/src/cli/commands/override.js matchedIdentity = npm:ZnJhaW0:2.0.183 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/override.jsView on unpkg

dist/src/cli/setup/first-run.jsView file

•matchType = normalized_sha256 matchedPackage = fraim@2.0.183 matchedPath = dist/src/cli/setup/first-run.js matchedIdentity = npm:ZnJhaW0:2.0.183 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/setup/first-run.jsView on unpkg

dist/src/cli/utils/remote-sync.jsView file

•matchType = normalized_sha256 matchedPackage = fraim@2.0.183 matchedPath = dist/src/cli/utils/remote-sync.js matchedIdentity = npm:ZnJhaW0:2.0.183 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/utils/remote-sync.jsView on unpkg

Source & flagged code

11 flagged

dist/src/core/utils/git-utils.jsView file

Lines 1-29javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.isExplicitLocalRepoPath = isExplicitLocalRepoPath;

4exports.getPort = getPort;

5exports.determineDatabaseName = determineDatabaseName;

6exports.getCurrentGitBranch = getCurrentGitBranch;

7exports.determineSchema = determineSchema;

8exports.getDefaultBranch = getDefaultBranch;

9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier;

10const child_process_1 = require("child_process");

11function extractLocalFolderLabel(rawPath) {

High

Child Process

Package source references child process execution.

dist/src/core/utils/git-utils.jsView on unpkg · L9

12 const normalized = rawPath

13 .trim()

14 .replace(/^file:\/\//i, '')

15 .replace(/\\/g, '/')

16 .replace(/\/+$/, '');

17 if (!normalized)

18 return undefined;

19 const parts = normalized.split('/').filter(Boolean);

20 const candidate = parts[parts.length - 1];

21 return candidate || undefined;

22}

23function isExplicitLocalRepoPath(repoUrl) {

24 if (!repoUrl || typeof repoUrl !== 'string') {

25 return false;

26 }

27 const trimmed = repoUrl.trim();

28 return (trimmed.startsWith('/') ||

29 trimmed.startsWith('\\') ||

bin/fraim.jsView file

Lines 1-14javascript

1#!/usr/bin/env node

2

3try {

4 require('../dist/src/cli/fraim.js');

5} catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/fraim.jsView on unpkg · L3

6 if (error && error.code

dist/src/first-run/session-service.jsView file

Lines 24-64javascript

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

dist/src/cli/doctor/checks/scripts-checks.jsView file

Lines 1-34javascript

1"use strict";

2/**

3 * Scripts checks for FRAIM doctor command

4 * Validates user scripts directory and sync status

5 * Issue #144: Enhanced doctor command

6 */

7var __importDefault = (this && this.__importDefault) ||

dist/src/cli/setup/user-level-sync.jsView file

Lines 75-115javascript

75 delete childEnv.NODE_UNIQUE_ID;

76 let pkg = {};

77 if (fs_1.default.existsSync(pkgPath)) {

78 try {

79 pkg = JSON

index.jsView file

•matchType = normalized_sha256 matchedPackage = fraim@2.0.183 matchedPath = index.js matchedIdentity = npm:ZnJhaW0:2.0.183 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

dist/src/cli/commands/override.jsView file

•matchType = normalized_sha256 matchedPackage = fraim@2.0.183 matchedPath = dist/src/cli/commands/override.js matchedIdentity = npm:ZnJhaW0:2.0.183 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/override.jsView on unpkg

dist/src/cli/setup/first-run.jsView file

•matchType = normalized_sha256 matchedPackage = fraim@2.0.183 matchedPath = dist/src/cli/setup/first-run.js matchedIdentity = npm:ZnJhaW0:2.0.183 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/setup/first-run.jsView on unpkg

dist/src/cli/utils/remote-sync.jsView file

•matchType = normalized_sha256 matchedPackage = fraim@2.0.183 matchedPath = dist/src/cli/utils/remote-sync.js matchedIdentity = npm:ZnJhaW0:2.0.183 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/utils/remote-sync.jsView on unpkg