registry / fraim / 2.0.201

fraim@2.0.201

⚠ Under review

FRAIM CLI - Framework for Rigor-based AI Management (alias for fraim-framework)

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 191 file(s), 2.45 MB of source, external domains: 127.0.0.1, accounts.google.com, ai.google.dev, antigravity.google, api.anthropic.com, api.dicebear.com, api.github.com, api.githubcopilot.com, api.stripe.com, app.seekout.com, astral.sh, cdn.jsdelivr.net, checkout.stripe.com, claude.ai, code.visualstudio.com, cursor.com, design.claude.ai, dev.azure.com, docs.astral.sh, docs.github.com, docs.gitlab.com, docs.microsoft.com, fonts.googleapis.com, fonts.gstatic.com, fraim.wellnessatwork.me, fraimworks.ai, github.com, gitlab.com, hooks.stripe.com, id.atlassian.com, js.stripe.com, kiro.dev, oauth2.googleapis.com, openai.com, registry.npmjs.org, support.atlassian.com, support.claude.com, windsurf.com, www.anthropic.com, www.claude.ai, www.fraimworks.ai, www.indeed.com, www.linkedin.com, www.w3.org, x.ai

Source & flagged code

9 flagged

package.jsonView file

Lines 26-66json

26 "test:ui": "playwright test --workers=1",

27 "test:ui:headed": "playwright test --headed --workers=1",

28 "hub:desktop": "npm run build && electron dist/src/ai-hub/desktop-main.js",

29 "hub:dev": "tsx scripts/start-hub-dev.ts",

30 "firstrun:dev": "tsx scripts/start-firstrun-dev.ts",

31 "sign:mac": "bash scripts/sign-macos-installer.sh",

32 "build:mac-installer": "bash scripts/build-macos-installer.sh",

33 "start:fraim": "tsx src/fraim-mcp-server.ts",

34 "dev:fraim": "tsx --watch src/fraim-mcp-server.ts",

35 "serve:website": "node fraim-pro/serve.js",

36 "watch:fraimlogs": "tsx scripts/watch-fraim-logs.ts > prodlogs.log 2>&1",

37 "manage-keys": "tsx scripts/fraim/manage-keys.ts",

38 "manage-teams": "tsx scripts/fraim/manage-teams.ts",

39 "partner-discounts": "tsx scripts/fraim/manage-partner-discounts.ts",

40 "fix-key": "tsx scripts/fraim/fix-expired-key.ts",

41 "backfill:persona-entitlements": "tsx scripts/backfill-persona-entitlements.ts",

42 "setup-stripe-webhook": "tsx scripts/fraim/setup-stripe-webhook.ts",

43 "view-signups": "tsx scripts/view-signups.ts",

44 "fraim:init": "npm run build && node index.js init",

45 "fraim:sync": "node index.js sync --local",

46 "postinstall": "node ./bin/fraim.js sync --skip-updates || echo 'FRAIM setup skipped.'",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L46

47 "prepublishOnly": "npm run build",

48 "release": "npm version patch && npm run publish-both",

49 "publish-both": "node scripts/publish-both.js",

50 "publish-fraim-only": "node scripts/publish-fraim.js",

51 "publish-both-manual": "node scripts/publish-both.js",

52 "validate:registry": "tsx scripts/verify-registry-paths.ts && npm run validate:jobs && npm run validate:skills && npm run validate:registry-references && npm run validate:platform-agnostic && npm run validate:template-namespaces && npm run validate:config-fallbacks && npm run validate:bootstrap-config-coverage && npm run validate:provider-action-mappings && npm run validate:fidelity && npm run validate:config-tokens && npm run validate:brain-mapping && npm run validate:template-syntax",

53 "validate:marketplaces": "tsx scripts/validate-marketplace-bundles.ts",

54 "typecheck:scripts": "tsc -p tsconfig.scripts.json --pretty false",

55 "validate:registry-references": "tsx scripts/validate-registry-references.ts",

56 "validate:brain-mapping": "tsx scripts/validate-brain-mapping.ts",

57 "validate:fraim-pro-assets": "tsx scripts/validate-fraim-pro-assets.ts",

58 "validate:employee-catalog": "tsx scripts/validate-employee-catalog.ts",

59 "validate:jobs": "tsx scripts/validate-jobs.ts",

60 "validate:platform-agnostic": "tsx scripts/validate-platform-agnostic.ts",

61 "validate:skills": "tsx scripts/validate-skills.ts",

62 "validate:template-namespaces": "tsx scripts/validate-template-namespaces.ts",

63 "validate:config-fallbacks": "tsx scripts/validate-config-fallbacks.ts",

64 "validate:bootstrap-config-coverage": "tsx scripts/validate-bootstrap-config-coverage.ts",

65 "validate:provider-action-mappings": "tsx scripts/validate-provider-action-mappings.ts",

66 "validate:fidelity": "tsx scripts/validate-fidelity.ts",

dist/src/core/utils/git-utils.jsView file

Lines 1-29javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.isExplicitLocalRepoPath = isExplicitLocalRepoPath;

4exports.getPort = getPort;

5exports.determineDatabaseName =

bin/fraim.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

3/**

4 * FRAIM Framework CLI Entry Point

5 *

6 * This file delegates to the compiled TypeScript implementation.

7 */

9try {

10 // In production/installed package, code is in dist/

11 require(

dist/src/ai-hub/word-sideload.jsView file

Lines 1-41javascript

1"use strict";

2/**

3 * Sideloads the Word add-in manifest so it appears in Word's Developer Add-ins

4 * list without admin rights or AppSource publishing.

5 *

6 * Windows: writes a registry value under HKCU\SOFTWARE\Microsoft\Office\16.0\WEF\Developer

7 * macOS: writes an entry to ~/Library/Containers/com.microsoft.Word/Data/Documents/wef/

8 *

9 * Both paths are non-admin and survive app updates (keyed by manifest GUID).

10 * Safe to call multiple times — checks before writing.

dist/src/cli/utils/org-publish.jsView file

Lines 46-86javascript

46 return `${httpUrl}/compare/${branch}?expand=1`;

47 return undefined;

48}

49/**

50 * Publish a set of org artifacts to the configured backend. Throws with a clear

51 * message when no backend is configured, a path is outside the pack layout, or

dist/src/cli/commands/override.jsView file

Lines 1-30javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod :

dist/src/cli/setup/user-level-sync.jsView file

Lines 75-115javascript

75 delete childEnv.NODE_UNIQUE_ID;

76 let pkg = {};

77 if (fs_1.default.existsSync(pkgPath)) {

78 try {

79 pkg = JSON

dist/src/cli/commands/add-provider.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = fraim@2.0.183 matchedIdentity = npm:ZnJhaW0:2.0.183 similarity = 0.758 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/cli/commands/add-provider.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code