registry / fraim-framework / 2.0.192

fraim-framework@2.0.192

⚠ Under review

FRAIM: AI Workforce Infrastructure — the organizational capability that turns AI agents into an accountable workforce, their operators into capable AI managers, and executives into leaders with clear optics on AI proficiency.

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 186 file(s), 2.35 MB of source, external domains: 127.0.0.1, accounts.google.com, ai.google.dev, antigravity.google, api.anthropic.com, api.dicebear.com, api.github.com, api.githubcopilot.com, api.stripe.com, app.seekout.com, astral.sh, cdn.jsdelivr.net, checkout.stripe.com, claude.ai, code.visualstudio.com, cursor.com, design.claude.ai, dev.azure.com, docs.astral.sh, docs.github.com, docs.gitlab.com, docs.microsoft.com, fonts.googleapis.com, fonts.gstatic.com, fraim.wellnessatwork.me, fraimworks.ai, github.com, gitlab.com, hooks.stripe.com, id.atlassian.com, js.stripe.com, kiro.dev, oauth2.googleapis.com, openai.com, support.atlassian.com, support.claude.com, windsurf.com, www.anthropic.com, www.claude.ai, www.fraimworks.ai, www.indeed.com, www.linkedin.com, x.ai

Source & flagged code

9 flagged

package.jsonView file

Lines 26-66json

26 "test:ui": "playwright test --workers=1",

27 "test:ui:headed": "playwright test --headed --workers=1",

28 "hub:desktop": "npm run build && electron dist/src/ai-hub/desktop-main.js",

29 "hub:dev": "tsx scripts/start-hub-dev.ts",

30 "firstrun:dev": "tsx scripts/start-firstrun-dev.ts",

31 "sign:mac": "bash scripts/sign-macos-installer.sh",

32 "build:mac-installer": "bash scripts/build-macos-installer.sh",

33 "start:fraim": "tsx src/fraim-mcp-server.ts",

34 "dev:fraim": "tsx --watch src/fraim-mcp-server.ts",

35 "serve:website": "node fraim-pro/serve.js",

36 "watch:fraimlogs": "tsx scripts/watch-fraim-logs.ts > prodlogs.log 2>&1",

37 "manage-keys": "tsx scripts/fraim/manage-keys.ts",

38 "manage-teams": "tsx scripts/fraim/manage-teams.ts",

39 "partner-discounts": "tsx scripts/fraim/manage-partner-discounts.ts",

40 "fix-key": "tsx scripts/fraim/fix-expired-key.ts",

41 "backfill:persona-entitlements": "tsx scripts/backfill-persona-entitlements.ts",

42 "setup-stripe-webhook": "tsx scripts/fraim/setup-stripe-webhook.ts",

43 "view-signups": "tsx scripts/view-signups.ts",

44 "fraim:init": "npm run build && node index.js init",

45 "fraim:sync": "node index.js sync --local",

46 "postinstall": "node ./bin/fraim.js sync --skip-updates || echo 'FRAIM setup skipped.'",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L46

47 "prepublishOnly": "npm run build",

48 "release": "npm version patch && npm run publish-both",

49 "publish-both": "node scripts/publish-both.js",

50 "publish-fraim-only": "node scripts/publish-fraim.js",

51 "publish-both-manual": "node scripts/publish-both.js",

52 "validate:registry": "tsx scripts/verify-registry-paths.ts && npm run validate:jobs && npm run validate:skills && npm run validate:registry-references && npm run validate:platform-agnostic && npm run validate:template-namespaces && npm run validate:config-fallbacks && npm run validate:bootstrap-config-coverage && npm run validate:provider-action-mappings && npm run validate:fidelity && npm run validate:config-tokens && npm run validate:brain-mapping && npm run validate:template-syntax",

53 "validate:marketplaces": "tsx scripts/validate-marketplace-bundles.ts",

54 "typecheck:scripts": "tsc -p tsconfig.scripts.json --pretty false",

55 "validate:registry-references": "tsx scripts/validate-registry-references.ts",

56 "validate:brain-mapping": "tsx scripts/validate-brain-mapping.ts",

57 "validate:fraim-pro-assets": "tsx scripts/validate-fraim-pro-assets.ts",

58 "validate:employee-catalog": "tsx scripts/validate-employee-catalog.ts",

59 "validate:jobs": "tsx scripts/validate-jobs.ts",

60 "validate:platform-agnostic": "tsx scripts/validate-platform-agnostic.ts",

61 "validate:skills": "tsx scripts/validate-skills.ts",

62 "validate:template-namespaces": "tsx scripts/validate-template-namespaces.ts",

63 "validate:config-fallbacks": "tsx scripts/validate-config-fallbacks.ts",

64 "validate:bootstrap-config-coverage": "tsx scripts/validate-bootstrap-config-coverage.ts",

65 "validate:provider-action-mappings": "tsx scripts/validate-provider-action-mappings.ts",

66 "validate:fidelity": "tsx scripts/validate-fidelity.ts",

dist/src/core/utils/git-utils.jsView file

Lines 1-29javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.isExplicitLocalRepoPath = isExplicitLocalRepoPath;

4exports.getPort = getPort;

5exports.determineDatabaseName =

bin/fraim.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

3/**

4 * FRAIM Framework CLI Entry Point

5 *

6 * This file delegates to the compiled TypeScript implementation.

7 */

9try {

10 // In production/installed package, code is in dist/

11 require(

dist/src/ai-hub/word-sideload.jsView file

Lines 1-41javascript

1"use strict";

2/**

3 * Sideloads the Word add-in manifest so it appears in Word's Developer Add-ins

4 * list without admin rights or AppSource publishing.

5 *

6 * Windows: writes a registry value under HKCU\SOFTWARE\Microsoft\Office\16.0\WEF\Developer

7 * macOS: writes an entry to ~/Library/Containers/com.microsoft.Word/Data/Documents/wef/

8 *

9 * Both paths are non-admin and survive app updates (keyed by manifest GUID).

10 * Safe to call multiple times — checks before writing.

dist/src/cli/doctor/checks/mcp-connectivity-checks.jsView file

Lines 33-73javascript

33 return function (mod) {

34 if (mod && mod.__esModule) return mod;

35 var result = {};

36 if (mod !=

dist/src/cli/commands/override.jsView file

Lines 1-30javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod

dist/src/cli/setup/user-level-sync.jsView file

Lines 75-115javascript

75 delete childEnv.NODE_UNIQUE_ID;

76 let pkg = {};

77 if (fs_1.default.existsSync(pkgPath)) {

78 try {

79 pkg = JSON

dist/src/cli/commands/add-provider.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = fraim-framework@2.0.183 matchedIdentity = npm:ZnJhaW0tZnJhbWV3b3Jr:2.0.183 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/cli/commands/add-provider.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code