fraim-framework: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

fraim-framework: Suspicious npm security report (Warn) | LPM Firewall

dist/src/ai-hub/word-sideload.jsView file

Lines 1-41javascript

1"use strict";

2/**

3 * Sideloads the Word add-in manifest so it appears in Word's Developer Add-ins

4 * list without admin rights or AppSource publishing.

5 *

6 * Windows: writes a registry value under HKCU\SOFTWARE\Microsoft\Office\16.0\WEF\Developer

7 * macOS: writes an entry to ~/Library/Containers/com.microsoft.Word/Data/Documents/wef/

8 *

9 * Both paths are non-admin and survive app updates (keyed by manifest GUID).

10 * Safe to call multiple times — checks before writing.

11 */

12var __importDefault = (this && this.__importDefault) || function (mod) {

13 return (mod && mod.__esModule) ? mod : { "default": mod };

14};

15Object.defineProperty(exports, "__esModule", { value: true });

16exports.isSideloaded = isSideloaded;

17exports.sideloadManifest = sideloadManifest;

18exports.removeSideload = removeSideload;

19const fs_1 = __importDefault(require("fs"));

20const path_1 = __importDefault(require("path"));

21const os_1 = __importDefault(require("os"));

22const child_process_1 = require("child_process");

23const MANIFEST_GUID = 'd1090951-50cf-4cf2-9d12-b0f8541d265c';

24function resolveManifestPath(projectPath) {

25 const candidates = [

26 path_1.default.resolve(projectPath, 'extensions/office-word/manifest.xml'),

27 path_1.default.resolve(__dirname, '..', '..', 'extensions/office-word/manifest.xml'),

28 path_1.default.resolve(__dirname, '..', '..', '..', 'extensions/office-word/manifest.xml'),

29 ];

30 return candidates.find(c => fs_1.default.existsSync(c)) ?? null;

31}

32function isSideloaded() {

33 if (process.platform === 'win32') {

34 const result = (0, child_process_1.spawnSync)('reg', [

35 'query',

36 `HKCU\\SOFTWARE\\Microsoft\\Office\\16.0\\WEF\\Developer`,

37 '/v', MANIFEST_GUID,

38 ], { encoding: 'utf8' });

39 return result.status === 0 && result.stdout.includes(MANIFEST_GUID);

40 }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/src/ai-hub/word-sideload.jsView on unpkg · L21

41 if (process.platform === 'darwin') {

dist/src/cli/utils/org-publish.jsView file

Lines 46-86javascript

46 return `${httpUrl}/compare/${branch}?expand=1`;

47 return undefined;

48}

49/**

50 * Publish a set of org artifacts to the configured backend. Throws with a clear

51 * message when no backend is configured, a path is outside the pack layout, or

52 * the backend operation fails.

53 */

54async function publishOrgArtifacts(artifacts, opts) {

55 const organization = (0, user_config_1.getOrganizationConfig)();

56 if (!organization) {

57 throw new Error('No organization backend configured. Run organization-onboarding or set the organization block in ~/.fraim/config.json.');

58 }

59 if (artifacts.length === 0)

60 throw new Error('No artifacts to publish.');

61 for (const a of artifacts) {

62 if (!PACK_RELATIVE_PATH.test(a.relativePath)) {

63 throw new Error(`Invalid org-pack path '${a.relativePath}' (must be context|rules|learnings/<name>.md).`);

64 }

65 }

66 if (organization.backend === 'fraim-cloud') {

67 const remoteUrl = opts?.remoteUrl || process.env.FRAIM_REMOTE_URL || 'https://fraim.wellnessatwork.me';

68 const apiKey = opts?.apiKey || (0, user_config_1.readUserFraimConfig)().apiKey;

69 if (!apiKey)

70 throw new Error('No FRAIM API key available for the fraim-cloud org backend.');

71 const res = await axios_1.default.post(`${remoteUrl.replace(/\/$/, '')}/api/org/publish`, { artifacts }, { headers: { 'x-api-key': apiKey }, timeout: 30_000 });

72 return { backend: 'fraim-cloud', version: String(res.data?.version ?? '') };

73 }

74 // git backend

75 const gitUrl = organization.gitUrl;

76 if (!ALLOWED_GIT_URL.test(gitUrl))

77 throw new Error(`Org repo URL has an unsupported scheme: ${gitUrl}`);

78 const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'fraim-org-pub-'));

79 try {

80 (0, child_process_1.execFileSync)('git', ['clone', '--depth=1', '--quiet', '--', gitUrl, '.'], {

81 cwd: dir, stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/cli/utils/org-publish.jsView on unpkg · L66

82 });

83 const branch = `fraim-org-update-${opts?.branchSuffix || `${process.pid}-${Date.now()}`}`;

84 (0, child_process_1.execFileSync)('git', ['checkout', '-b', branch], { cwd: dir, stdio: ['ignore', 'pipe', 'pipe'] });

85 for (const a of artifacts) {

86 const dest = path_1.default.join(dir, a.relativePath);

dist/src/cli/commands/override.jsView file

Lines 1-30javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.overrideCommand = void 0;

7const commander_1 = require("commander");

8const fs_1 = __importDefault(require("fs"));

9const path_1 = __importDefault(require("path"));

10const chalk_1 = __importDefault(require("chalk"));

11const axios_1 = __importDefault(require("axios"));

12const git_utils_1 = require("../../core/utils/git-utils");

13const project_fraim_paths_1 = require("../../core/utils/project-fraim-paths");

14exports.overrideCommand = new commander_1.Command('override')

15 .description('Create a local override for a FRAIM registry file')

16 .argument('<path>', 'Registry path to override (e.g., jobs/product-building/spec.md)')

17 .option('--inherit', 'Create override with {{ import }} directive (inherits from global)')

18 .option('--copy', 'Copy current content from server to local')

19 .option('--local', 'Fetch from local development server (port derived from git branch)')

20 .action(async (registryPath, options) => {

21 const projectRoot = process.cwd();

22 const configPath = (0, project_fraim_paths_1.getWorkspaceConfigPath)(projectRoot);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/cli/commands/override.jsView on unpkg · L10

23 const personalizedRootDisplayPath = (0, project_fraim_paths_1.getWorkspaceFraimDisplayPath)('personalized-employee');

24 if (!(0, project_fraim_paths_1.workspaceFraimExists)(projectRoot)) {

25 console.log(chalk_1.default.red(`❌ ${(0, project_fraim_paths_1.getWorkspaceFraimDisplayPath)()} directory not found. Run "fraim setup" or "fraim init-project" first.`));

26 process.exit(1);

27 }

28 if (registryPath.includes('..') || path_1.default.isAbsolute(registryPath)) {

29 console.log(chalk_1.default.red('❌ Invalid path. Path must be relative and cannot contain ".."'));

30 process.exit(1);

dist/src/cli/setup/user-level-sync.jsView file

Lines 75-115javascript

75 delete childEnv.NODE_UNIQUE_ID;

76 let pkg = {};

77 if (fs_1.default.existsSync(pkgPath)) {

78 try {

79 pkg = JSON.parse(fs_1.default.readFileSync(pkgPath, 'utf8'));

80 }

81 catch {

82 // Corrupt package.json — overwrite below rather than crash.

83 pkg = {};

84 }

85 }

86 pkg.name = pkg.name || 'fraim-user-runtime';

87 pkg.private = true;

88 pkg.dependencies = { ...(pkg.dependencies || {}), ...USER_LEVEL_RUNTIME_DEPS };

89 fs_1.default.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2));

90 const missing = Object.keys(USER_LEVEL_RUNTIME_DEPS).filter((dep) => !fs_1.default.existsSync(path_1.default.join(nodeModulesDir, dep)));

91 if (missing.length === 0) {

92 return;

93 }

94 console.log(chalk_1.default.blue(`📦 Installing user-level runtime dependencies (${missing.join(', ')})...`));

95 try {

96 (0, child_process_1.execSync)('npm install --no-audit --no-fund --no-save --no-package-lock --omit=dev', {

97 cwd: baseDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/setup/user-level-sync.jsView on unpkg · L95

98 stdio: 'pipe',

99 env: childEnv,

100 });

101 console.log(chalk_1.default.green(`✅ Installed: ${missing.join(', ')}`));

102 }

103 catch (error) {

104 const stderr = error?.stderr?.toString?.() || error?.message || 'unknown error';

105 console.log(chalk_1.default.yellow(`⚠️ Could not install user-level deps (${missing.join(', ')}): ${stderr.split('\n')[0]}`));

106 console.log(chalk_1.default.gray(` Skills that depend on these will surface a clear error when invoked.`));

107 console.log(chalk_1.default.gray(` To retry manually: cd ${baseDir} && npm install`));

108 }

109}

110/**

111 * Set up the user-level FRAIM directory.

112 * Creates the personalized-employee structure so FRAIM works outside any project.

113 *

114 * @param userFraimDir - Override for the target directory (for testing)

115 */