registry / fraim-hub / 2.0.204

fraim-hub@2.0.204

FRAIM Hub local companion package.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 82 file(s), 1.46 MB of source, external domains: 127.0.0.1, ai.google.dev, antigravity.google, api.dicebear.com, api.githubcopilot.com, app.seekout.com, claude.ai, code.visualstudio.com, cursor.com, docs.github.com, docs.gitlab.com, docs.microsoft.com, fraim.wellnessatwork.me, fraimworks.ai, github.com, gitlab.com, id.atlassian.com, kiro.dev, openai.com, registry.npmjs.org, support.atlassian.com, windsurf.com, www.anthropic.com, www.indeed.com, www.linkedin.com, www.w3.org, x.ai

Source & flagged code

5 flagged

dist/src/core/utils/git-utils.jsView file

Lines 1-29javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.isExplicitLocalRepoPath = isExplicitLocalRepoPath;

4exports.getPort = getPort;

5exports.determineDatabaseName = determineDatabaseName;

6exports.getCurrentGitBranch = getCurrentGitBranch;

7exports.determineSchema = determineSchema;

8exports.getDefaultBranch = getDefaultBranch;

9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier;

10const child_process_1 = require("child_process");

11function extractLocalFolderLabel(rawPath) {

High

Child Process

Package source references child process execution.

dist/src/core/utils/git-utils.jsView on unpkg · L9

12 const normalized = rawPath

13 .trim()

14 .replace(/^file:\/\//i, '')

15 .replace(/\\/g, '/')

16 .replace(/\/+$/, '');

17 if (!normalized)

18 return undefined;

19 const parts = normalized.split('/').filter(Boolean);

20 const candidate = parts[parts.length - 1];

21 return candidate || undefined;

22}

23function isExplicitLocalRepoPath(repoUrl) {

24 if (!repoUrl || typeof repoUrl !== 'string') {

25 return false;

26 }

27 const trimmed = repoUrl.trim();

28 return (trimmed.startsWith('/') ||

29 trimmed.startsWith('\\') ||

bin/fraim-hub.jsView file

Lines 1-18javascript

1#!/usr/bin/env node

3try {

4 const { createFraimHubProgram } = require('../dist/src/cli/fraim-hub.js');

5 createFraimHubProgram().parseAsync(process.argv).catch((error) => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/fraim-hub.jsView on unpkg · L3

dist/src/ai-hub/office-sideload.jsView file

Lines 11-51javascript

11 * macOS: copies the manifest into each app's

12 * ~/Library/Containers/<bundle>/Data/Documents/wef/<guid>.xml

13 *

14 * NOTE: the manifest XML

dist/src/ai-hub/managed-browser.jsView file

Lines 7-47javascript

7exports.browserExecutableCandidates = browserExecutableCandidates;

8exports.resolveBrowserExecutable = resolveBrowserExecutable;

9exports.buildBrowserLaunchArgs = buildBrowserLaunchArgs;

10exports.buildBrowserContextNote = buildBrowserContextNote;

11exports.defaultBrowserProfileDir = defaultBrowserProfileDir;

12exports.probeCdpEndpoint = probeCdpEndpoint;

dist/src/ai-hub/server.jsView file

Lines 2997-3037javascript

2997 });

2998 this.runRegistry.dispose(directId);

2999 },

3000 }, startSessionSeedForHost(hostId, directRun.id), launchContext);

3001 this.runRegistry.attachChildIfRunning(directRun.id, directChild);

3002 }

3003 const existingPreferences =

Source & flagged code

5 flagged · loading source

dist/src/core/utils/git-utils.jsView file

9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier; L10: const child_process_1 = require("child_process"); L11: function extractLocalFolderLabel(rawPath) {

High

Child Process

Package source references child process execution.

dist/src/core/utils/git-utils.jsView on unpkg · L9

bin/fraim-hub.jsView file

3try { L4: const { createFraimHubProgram } = require('../dist/src/cli/fraim-hub.js'); L5: createFraimHubProgram().parseAsync(process.argv).catch((error) => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/fraim-hub.jsView on unpkg · L3

dist/src/ai-hub/office-sideload.jsView file

31const os_1 = __importDefault(require("os")); L32: const child_process_1 = require("child_process"); L33: const WEF_DEVELOPER_KEY = 'HKCU\\SOFTWARE\\Microsoft\\Office\\16.0\\WEF\\Developer'; ... L38: path_1.default.resolve(base, 'extensions/office-word/manifest.xml'), L39: path_1.default.resolve(__dirname, '..', '..', 'extensions/office-word/manifest.xml'), L40: path_1.default.resolve(__dirname, '..', '..', '..', 'extensions/office-word/manifest.xml'), ... L80: const r = (0, child_process_1.spawnSync)('reg', ['query', WEF_DEVELOPER_KEY, '/v', guid], { encoding: 'utf8' }); L81: if (r.status !== 0 || !r.stdout.includes('REG_SZ')) L82: return null; ... L97: function isManifestSideloaded(m) { L98: if (process.platform === 'win32') { L99: const value = winRegisteredValue(m.guid);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/src/ai-hub/office-sideload.jsView on unpkg · L31

dist/src/ai-hub/managed-browser.jsView file

27*/ L28: const child_process_1 = require("child_process"); L29: const http_1 = __importDefault(require("http")); L30: const os_1 = __importDefault(require("os")); ... L36: */ L37: function browserExecutableCandidates(platform = process.platform, env = process.env) { L38: if (platform === 'win32') {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/ai-hub/managed-browser.jsView on unpkg · L27

dist/src/ai-hub/server.jsView file

3017try { L3018: const syncChild = (0, child_process_1.spawn)('npx', ['fraim', 'sync'], { cwd: projectPath, detached: true, stdio: 'ignore' }); L3019: syncChild.on('error', () => { });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/ai-hub/server.jsView on unpkg · L3017

Findings

3 High5 Medium4 Low

HighChild Processdist/src/core/utils/git-utils.js

HighSame File Env Network Executiondist/src/ai-hub/managed-browser.js

HighRuntime Package Installdist/src/ai-hub/server.js

MediumDynamic Requirebin/fraim-hub.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/src/ai-hub/office-sideload.js

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/src/core/utils/git-utils.jsView file

Lines 1-29javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.isExplicitLocalRepoPath = isExplicitLocalRepoPath;

4exports.getPort = getPort;

5exports.determineDatabaseName = determineDatabaseName;

6exports.getCurrentGitBranch = getCurrentGitBranch;

7exports.determineSchema = determineSchema;

8exports.getDefaultBranch = getDefaultBranch;

9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier;

10const child_process_1 = require("child_process");

11function extractLocalFolderLabel(rawPath) {

High

Child Process

Package source references child process execution.

dist/src/core/utils/git-utils.jsView on unpkg · L9

12 const normalized = rawPath

13 .trim()

14 .replace(/^file:\/\//i, '')

15 .replace(/\\/g, '/')

16 .replace(/\/+$/, '');

17 if (!normalized)

18 return undefined;

19 const parts = normalized.split('/').filter(Boolean);

20 const candidate = parts[parts.length - 1];

21 return candidate || undefined;

22}

23function isExplicitLocalRepoPath(repoUrl) {

24 if (!repoUrl || typeof repoUrl !== 'string') {

25 return false;

26 }

27 const trimmed = repoUrl.trim();

28 return (trimmed.startsWith('/') ||

29 trimmed.startsWith('\\') ||

bin/fraim-hub.jsView file

Lines 1-18javascript

1#!/usr/bin/env node

3try {

4 const { createFraimHubProgram } = require('../dist/src/cli/fraim-hub.js');

5 createFraimHubProgram().parseAsync(process.argv).catch((error) => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/fraim-hub.jsView on unpkg · L3

dist/src/ai-hub/office-sideload.jsView file

Lines 11-51javascript

11 * macOS: copies the manifest into each app's

12 * ~/Library/Containers/<bundle>/Data/Documents/wef/<guid>.xml

13 *

14 * NOTE: the manifest XML

dist/src/ai-hub/managed-browser.jsView file

Lines 7-47javascript

7exports.browserExecutableCandidates = browserExecutableCandidates;

8exports.resolveBrowserExecutable = resolveBrowserExecutable;

9exports.buildBrowserLaunchArgs = buildBrowserLaunchArgs;

10exports.buildBrowserContextNote = buildBrowserContextNote;

11exports.defaultBrowserProfileDir = defaultBrowserProfileDir;

12exports.probeCdpEndpoint = probeCdpEndpoint;

dist/src/ai-hub/server.jsView file

Lines 2997-3037javascript

2997 });

2998 this.runRegistry.dispose(directId);

2999 },

3000 }, startSessionSeedForHost(hostId, directRun.id), launchContext);

3001 this.runRegistry.attachChildIfRunning(directRun.id, directChild);

3002 }

3003 const existingPreferences =