registry / fraim / 2.0.204

fraim@2.0.204

⚠ Under review

FRAIM core CLI and MCP package.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 168 file(s), 1.55 MB of source, external domains: 127.0.0.1, accounts.google.com, ai.google.dev, antigravity.google, api.anthropic.com, api.dicebear.com, api.github.com, api.githubcopilot.com, api.stripe.com, app.seekout.com, astral.sh, cdn.jsdelivr.net, checkout.stripe.com, claude.ai, code.visualstudio.com, cursor.com, design.claude.ai, dev.azure.com, docs.astral.sh, docs.github.com, docs.gitlab.com, docs.microsoft.com, fonts.googleapis.com, fonts.gstatic.com, fraim.wellnessatwork.me, fraimworks.ai, github.com, gitlab.com, hooks.stripe.com, id.atlassian.com, js.stripe.com, kiro.dev, oauth2.googleapis.com, openai.com, support.atlassian.com, support.claude.com, windsurf.com, www.anthropic.com, www.claude.ai, www.fraimworks.ai, www.indeed.com, www.linkedin.com, x.ai

Source & flagged code

7 flagged

dist/src/core/utils/git-utils.jsView file

Lines 1-29javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.isExplicitLocalRepoPath = isExplicitLocalRepoPath;

4exports.getPort = getPort;

5exports.determineDatabaseName = determineDatabaseName;

6exports.getCurrentGitBranch = getCurrentGitBranch;

7exports.determineSchema = determineSchema;

8exports.getDefaultBranch = getDefaultBranch;

9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier;

10const child_process_1 = require("child_process");

11function extractLocalFolderLabel(rawPath) {

High

Child Process

Package source references child process execution.

dist/src/core/utils/git-utils.jsView on unpkg · L9

12 const normalized = rawPath

13 .trim()

14 .replace(/^file:\/\//i, '')

15 .replace(/\\/g, '/')

16 .replace(/\/+$/, '');

17 if (!normalized)

18 return undefined;

19 const parts = normalized.split('/').filter(Boolean);

20 const candidate = parts[parts.length - 1];

21 return candidate || undefined;

22}

23function isExplicitLocalRepoPath(repoUrl) {

24 if (!repoUrl || typeof repoUrl !== 'string') {

25 return false;

26 }

27 const trimmed = repoUrl.trim();

28 return (trimmed.startsWith('/') ||

29 trimmed.startsWith('\\') ||

bin/fraim.jsView file

Lines 1-14javascript

1#!/usr/bin/env node

3try {

4 require('../dist/src/cli/fraim.js');

5} catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/fraim.jsView on unpkg · L3

6 if (error && error.code

dist/src/first-run/session-service.jsView file

Lines 23-63javascript

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod &&

dist/src/cli/utils/org-publish.jsView file

Lines 46-86javascript

46 return `${httpUrl}/compare/${branch}?expand=1`;

47 return undefined;

48}

49/**

50 * Publish a set of org artifacts to the configured backend. Throws with a clear

51 * message when no backend is configured, a path is outside the pack layout, or

dist/src/cli/commands/override.jsView file

Lines 1-30javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod :

dist/src/cli/setup/user-level-sync.jsView file

Lines 75-115javascript

75 delete childEnv.NODE_UNIQUE_ID;

76 let pkg = {};

77 if (fs_1.default.existsSync(pkgPath)) {

78 try {

79 pkg = JSON

dist/src/cli/commands/add-provider.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = fraim@2.0.183 matchedIdentity = npm:ZnJhaW0:2.0.183 similarity = 0.650 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/cli/commands/add-provider.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/src/core/utils/git-utils.jsView file

9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier; L10: const child_process_1 = require("child_process"); L11: function extractLocalFolderLabel(rawPath) {

High

Child Process

Package source references child process execution.

dist/src/core/utils/git-utils.jsView on unpkg · L9

bin/fraim.jsView file

3try { L4: require('../dist/src/cli/fraim.js'); L5: } catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/fraim.jsView on unpkg · L3

dist/src/first-run/session-service.jsView file

43const crypto_1 = __importDefault(require("crypto")); L44: const child_process_1 = require("child_process"); L45: const ide_detector_1 = require("../cli/setup/ide-detector"); ... L55: function getFakeStateMode() { L56: if (process.env.FRAIM_FIRST_RUN_FAKE !== '1') L57: return null; ... L64: function commandVersion(command, extraBinDirs, basePath) { L65: const executable = process.platform === 'win32' ? 'cmd.exe' : command; L66: const args = process.platform === 'win32' ... L79: return null; L80: const text = `${result.stdout || ''}${result.stderr || ''}`.split(/\r?\n/)[0]?.trim() || null; L81: return text;

Findings

1 Critical4 High5 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/src/cli/commands/add-provider.js

HighChild Processdist/src/core/utils/git-utils.js

HighSame File Env Network Executiondist/src/cli/utils/org-publish.js

HighSandbox Evasion Gated Capabilitydist/src/cli/commands/override.js

HighRuntime Package Installdist/src/cli/setup/user-level-sync.js

MediumDynamic Requirebin/fraim.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/src/first-run/session-service.js

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings