fraim-hub@2.0.217: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

fraim-hub@2.0.217: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/src/core/utils/git-utils.jsView file

9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier; L10: const child_process_1 = require("child_process"); L11: function extractLocalFolderLabel(rawPath) {

High

Child Process

Package source references child process execution.

dist/src/core/utils/git-utils.jsView on unpkg · L9

bin/fraim-hub.jsView file

3try { L4: const { createFraimHubProgram } = require('../dist/src/cli/fraim-hub.js'); L5: createFraimHubProgram().parseAsync(process.argv).catch((error) => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/fraim-hub.jsView on unpkg · L3

dist/src/ai-hub/word-sideload.jsView file

21const os_1 = __importDefault(require("os")); L22: const child_process_1 = require("child_process"); L23: const MANIFEST_GUID = 'd1090951-50cf-4cf2-9d12-b0f8541d265c'; ... L26: path_1.default.resolve(projectPath, 'extensions/office-word/manifest.xml'), L27: path_1.default.resolve(__dirname, '..', '..', 'extensions/office-word/manifest.xml'), L28: path_1.default.resolve(__dirname, '..', '..', '..', 'extensions/office-word/manifest.xml'), ... L32: function isSideloaded() { L33: if (process.platform === 'win32') { L34: const result = (0, child_process_1.spawnSync)('reg', [ ... L38: ], { encoding: 'utf8' }); L39: return result.status === 0 && result.stdout.includes(MANIFEST_GUID); L40: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/src/ai-hub/word-sideload.jsView on unpkg · L21

dist/src/ai-hub/managed-browser.jsView file

27*/ L28: const child_process_1 = require("child_process"); L29: const http_1 = __importDefault(require("http")); L30: const os_1 = __importDefault(require("os")); ... L36: */ L37: function browserExecutableCandidates(platform = process.platform, env = process.env) { L38: if (platform === 'win32') {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/ai-hub/managed-browser.jsView on unpkg · L27

dist/src/config/learning-domains.jsView file

191contains invisible/control Unicode U+FEFF (zero width no-break space) const fm = jobFileContent.match(/^<U+FEFF>?---\r?\n([\s\S]*?)\r?\n---/);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/src/config/learning-domains.jsView on unpkg · L191

•Trigger-reachable chain: manifest.bin -> bin/fraim-hub.js -> dist/src/cli/fraim-hub.js -> dist/src/ai-hub/cli.js -> dist/src/ai-hub/server.js -> dist/src/local-mcp-server/learning-context-builder.js -> dist/src/config/learning-domains.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/src/config/learning-domains.jsView on unpkg

dist/src/ai-hub/server.jsView file

3250try { L3251: const syncChild = (0, child_process_1.spawn)('npx', ['fraim', 'sync'], { cwd: projectPath, detached: true, stdio: 'ignore' }); L3252: syncChild.on('error', () => { });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/ai-hub/server.jsView on unpkg · L3250

Source & flagged code

7 flagged

dist/src/core/utils/git-utils.jsView file

Lines 1-29javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.isExplicitLocalRepoPath = isExplicitLocalRepoPath;

4exports.getPort = getPort;

5exports.determineDatabaseName = determineDatabaseName;

6exports.getCurrentGitBranch = getCurrentGitBranch;

7exports.determineSchema = determineSchema;

8exports.getDefaultBranch = getDefaultBranch;

9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier;

10const child_process_1 = require("child_process");

11function extractLocalFolderLabel(rawPath) {

High

Child Process

Package source references child process execution.

dist/src/core/utils/git-utils.jsView on unpkg · L9

12 const normalized = rawPath

13 .trim()

14 .replace(/^file:\/\//i, '')

15 .replace(/\\/g, '/')

16 .replace(/\/+$/, '');

17 if (!normalized)

18 return undefined;

19 const parts = normalized.split('/').filter(Boolean);

20 const candidate = parts[parts.length - 1];

21 return candidate || undefined;

22}

23function isExplicitLocalRepoPath(repoUrl) {

24 if (!repoUrl || typeof repoUrl !== 'string') {

25 return false;

26 }

27 const trimmed = repoUrl.trim();

28 return (trimmed.startsWith('/') ||

29 trimmed.startsWith('\\') ||

bin/fraim-hub.jsView file

Lines 1-18javascript

1#!/usr/bin/env node

2

3try {

4 const { createFraimHubProgram } = require('../dist/src/cli/fraim-hub.js');

5 createFraimHubProgram().parseAsync(process.argv).catch((error)

dist/src/ai-hub/word-sideload.jsView file

Lines 1-41javascript

1"use strict";

2/**

3 * Sideloads the Word add-in manifest so it appears in Word's Developer Add-ins

4 * list without admin rights or AppSource publishing.

5 *

6 * Windows: writes a registry value under HKCU\SOFTWARE\Microsoft\Office\16.0\WEF\Developer

7 * macOS: writes an entry to ~/Library/Containers/com.microsoft.Word/Data/Documents/wef/

8 *

9 * Both paths are non-admin and survive app updates (keyed by manifest GUID).

10 * Safe to call multiple times — checks before writing.

dist/src/ai-hub/managed-browser.jsView file

Lines 7-47javascript

7exports.browserExecutableCandidates = browserExecutableCandidates;

8exports.resolveBrowserExecutable = resolveBrowserExecutable;

9exports.buildBrowserLaunchArgs = buildBrowserLaunchArgs;

10exports.buildBrowserContextNote = buildBrowserContextNote;

11exports.defaultBrowserProfileDir = defaultBrowserProfileDir;

dist/src/config/learning-domains.jsView file

Lines 171-211javascript

171 */

172function resolveJobDomain(registryPath) {

173 const category = jobCategoryFromRegistryPath(registryPath);

174 if (!category)

dist/src/ai-hub/server.jsView file

Lines 3230-3270javascript

3230 });

3231 this.runRegistry.dispose(directId);

3232 },

3233 }, startSessionSeedForHost(hostId, directRun.id), launchContext);

3234 this.runRegistry.attachChildIfRunning(directRun.id, directChild);

3235 }

3236