fraim@2.0.276
FRAIM core CLI and MCP package.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete unconsented install-time attack chain was found. The explicit CLI setup flow has broad agent-configuration and telemetry capabilities, so it warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Running fraim first-run, fraim add-ide, or fraim init-project with a detected supported IDE.
Impact
Changes agent invocation surfaces and transmits usage telemetry under the user's FRAIM API key.
Mechanism
User-level agent configuration, telemetry enablement, and authenticated analytics upload.
AI rationale
No concrete unconsented install-time attack chain was found. The explicit CLI setup flow has broad agent-configuration and telemetry capabilities, so it warrants a warning rather than a block.
Evidence
package.jsonbin/fraim.jsdist/src/first-run/session-service.jsdist/src/cli/setup/claude-code-telemetry.jsdist/src/cli/setup/ide-global-integration.jsdist/src/local-mcp-server/usage-collector.js~/.claude/settings.json~/.claude/skills/fraim/SKILL.md~/.claude/commands/fraim.md~/.codex/skills/fraim/SKILL.md~/.cursor/rules/fraim.mdc
Network endpoints2
localhost:4318fraim.wellnessatwork.me/api/analytics/events
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- First-run setup auto-configures every detected IDE, then installs user-level agent artifacts.
- Claude setup writes telemetry environment variables into ~/.claude/settings.json for all Claude Code sessions.
- The local MCP proxy sends usage events, including its API key, to the FRAIM remote API.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The package bin only loads the CLI; setup changes require a user-invoked CLI/wizard flow.
- Telemetry receiver is configured for localhost:4318, not a direct external collector.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
11 flagged · loading sourcedist/src/core/utils/git-utils.jsView file
9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier;
L10: const child_process_1 = require("child_process");
L11: function extractLocalFolderLabel(rawPath) {
High
Child Process
Package source references child process execution.
dist/src/core/utils/git-utils.jsView on unpkg · L9bin/fraim.jsView file
3try {
L4: require('../dist/src/cli/fraim.js');
L5: } catch (error) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/fraim.jsView on unpkg · L3dist/src/first-run/session-service.jsView file
44Trigger-reachable persistence chain: manifest.bin -> bin/fraim.js -> dist/src/cli/fraim.js -> dist/src/cli/commands/setup.js -> dist/src/first-run/session-service.js
L44: const crypto_1 = __importDefault(require("crypto"));
L45: const child_process_1 = require("child_process");
L46: const ide_detector_1 = require("../cli/setup/ide-detector");
...
L55: function getFakeStateMode() {
L56: if (process.env.FRAIM_FIRST_RUN_FAKE !== '1')
L57: return null;
...
L64: function commandVersion(command, extraBinDirs, basePath) {
L65: const executable = process.platform === 'win32' ? 'cmd.exe' : command;
L66: const args = process.platform === 'win32'
...
L79: return null;
L80: const text = `${result.stdout || ''}${result.stderr || ''}`.split(/\r?\n/)[0]?.trim() || null;
L81: return text;
Findings
9 High5 Medium4 Low
HighChild Processdist/src/core/utils/git-utils.js
HighSandbox Evasion Gated Capabilitydist/src/cli/doctor/checks/scripts-checks.js
HighTrigger Reachable Persistencedist/src/first-run/session-service.js
HighRuntime Package Installdist/src/cli/setup/user-level-sync.js
HighKnown Malware Source Similarityindex.js
HighKnown Malware Source Similaritydist/src/cli/commands/override.js
HighKnown Malware Source Similaritydist/src/cli/setup/first-run.js
HighKnown Malware Source Similaritydist/src/cli/setup/claude-code-telemetry.js
HighKnown Malware Source Similaritydist/src/cli/utils/git-org-sync.js
MediumDynamic Requirebin/fraim.js
Medium
Affected versions and remediation
This report applies to fraim@2.0.276.
See all versions of fraim for other recorded verdicts.
- Review the evidence and your use of fraim@2.0.276 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.