registry / fraim / 2.0.261

fraim@2.0.261

FRAIM core CLI and MCP package.

AI Security Review

scanned 19d ago · by lpm-firewall-ai

An explicit `fraim setup`/`fraim add-ide` can modify detected AI IDE MCP configurations. The installed MCP entry launches the latest npm fraim package, creating a continuing remote-code update path.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

User runs `fraim setup` or `fraim add-ide`, then an IDE starts the configured MCP server.

Impact

Configured IDEs may execute a newer remotely retrieved fraim release and receive FRAIM remote content.

Mechanism

AI-agent configuration mutation with unpinned npm package execution

Rationale

No concrete malicious install-time behavior or covert credential theft was found. The user-invoked, broad AI-agent configuration plus unpinned remote execution warrants a warning.

Evidence

package.jsondist/src/cli/commands/setup.jsdist/src/cli/commands/add-ide.jsdist/src/cli/mcp/mcp-server-registry.jsdist/src/cli/mcp/fraim-mcp-latest-launcher.jsdist/src/cli/utils/remote-sync.js~/.fraim/bin/fraim-mcp-latest.js~/.fraim/npm-cache/mcp/selected IDE MCP configuration filesproject fraim/ sync directories

Network endpoints1

fraim.wellnessatwork.me

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

dist/src/cli/commands/setup.js makes `fraim setup` configure detected IDE MCP configs and sync user artifacts.
dist/src/cli/mcp/mcp-server-registry.js registers git and Playwright MCP servers plus FRAIM.
dist/src/cli/mcp/fraim-mcp-latest-launcher.js writes a launcher that resolves latest fraim via npm and executes it with npx.
dist/src/cli/utils/remote-sync.js fetches registry content from the FRAIM remote and writes synced files.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hook.
Entrypoints only dispatch the CLI; setup and sync require an explicit user command.
IDE configuration is described to the user and interactive selection supports opting out.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

10 flagged

dist/src/core/utils/git-utils.jsView file

Lines 1-29javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.isExplicitLocalRepoPath = isExplicitLocalRepoPath;

4exports.getPort = getPort;

5exports.determineDatabaseName = determineDatabaseName;

6exports.getCurrentGitBranch = getCurrentGitBranch;

7exports.determineSchema = determineSchema;

8exports.getDefaultBranch = getDefaultBranch;

9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier;

10const child_process_1 = require("child_process");

11function extractLocalFolderLabel(rawPath) {

High

Child Process

Package source references child process execution.

dist/src/core/utils/git-utils.jsView on unpkg · L9

12 const normalized = rawPath

13 .trim()

14 .replace(/^file:\/\//i, '')

15 .replace(/\\/g, '/')

16 .replace(/\/+$/, '');

17 if (!normalized)

18 return undefined;

19 const parts = normalized.split('/').filter(Boolean);

20 const candidate = parts[parts.length - 1];

21 return candidate || undefined;

22}

23function isExplicitLocalRepoPath(repoUrl) {

24 if (!repoUrl || typeof repoUrl !== 'string') {

25 return false;

26 }

27 const trimmed = repoUrl.trim();

28 return (trimmed.startsWith('/') ||

29 trimmed.startsWith('\\') ||

•matchType = normalized_sha256 matchedPackage = fraim-framework@2.0.185 matchedPath = dist/src/core/utils/git-utils.js matchedIdentity = npm:ZnJhaW0tZnJhbWV3b3Jr:2.0.185 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/core/utils/git-utils.jsView on unpkg

bin/fraim.jsView file

Lines 1-14javascript

1#!/usr/bin/env node

3try {

4 require('../dist/src/cli/fraim.js');

5} catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/fraim.jsView on unpkg · L3

6 if (error && error.code

dist/src/first-run/session-service.jsView file

Lines 24-64javascript

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

dist/src/cli/doctor/checks/scripts-checks.jsView file

Lines 1-34javascript

1"use strict";

2/**

3 * Scripts checks for FRAIM doctor command

4 * Validates user scripts directory and sync status

5 * Issue #144: Enhanced doctor command

6 */

7var __importDefault = (this && this.__importDefault) ||

dist/src/cli/setup/user-level-sync.jsView file

Lines 75-115javascript

75 delete childEnv.NODE_UNIQUE_ID;

76 let pkg = {};

77 if (fs_1.default.existsSync(pkgPath)) {

78 try {

79 pkg = JSON

index.jsView file

•matchType = normalized_sha256 matchedPackage = fraim-framework@2.0.185 matchedPath = index.js matchedIdentity = npm:ZnJhaW0tZnJhbWV3b3Jr:2.0.185 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

dist/src/cli/commands/override.jsView file

•matchType = normalized_sha256 matchedPackage = fraim-framework@2.0.185 matchedPath = dist/src/cli/commands/override.js matchedIdentity = npm:ZnJhaW0tZnJhbWV3b3Jr:2.0.185 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/override.jsView on unpkg

dist/src/cli/setup/first-run.jsView file

•matchType = normalized_sha256 matchedPackage = fraim-framework@2.0.185 matchedPath = dist/src/cli/setup/first-run.js matchedIdentity = npm:ZnJhaW0tZnJhbWV3b3Jr:2.0.185 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/setup/first-run.jsView on unpkg

Source & flagged code

10 flagged · loading source

dist/src/core/utils/git-utils.jsView file

9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier; L10: const child_process_1 = require("child_process"); L11: function extractLocalFolderLabel(rawPath) {

High

Child Process

Package source references child process execution.

dist/src/core/utils/git-utils.jsView on unpkg · L9

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/core/utils/git-utils.jsView on unpkg

bin/fraim.jsView file

3try { L4: require('../dist/src/cli/fraim.js'); L5: } catch (error) {

Medium

Findings

8 High5 Medium4 Low

HighChild Processdist/src/core/utils/git-utils.js

HighSandbox Evasion Gated Capabilitydist/src/cli/doctor/checks/scripts-checks.js

HighRuntime Package Installdist/src/cli/setup/user-level-sync.js

HighKnown Malware Source Similaritydist/src/cli/setup/user-level-sync.js

HighKnown Malware Source Similaritydist/src/core/utils/git-utils.js

HighKnown Malware Source Similarityindex.js

HighKnown Malware Source Similaritydist/src/cli/commands/override.js

HighKnown Malware Source Similaritydist/src/cli/setup/first-run.js

MediumDynamic Requirebin/fraim.js

MediumNetwork

MediumEnvironment Vars

Medium