registry / fraim / 2.0.277

fraim@2.0.277

FRAIM core CLI and MCP package.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

Source inspection found no lifecycle hook or concrete attack behavior. The flagged telemetry and agent setup is reachable through CLI setup commands and uses a localhost metrics receiver or FRAIM-managed files.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user runs project initialization or adds an IDE, with Claude Code detected or selected.

Impact

The inspected behavior enables local token metrics and does not establish disclosure to an unrelated recipient or unauthorized agent control.

Mechanism

The command adds missing telemetry environment variables to Claude Code user settings; agent adapter files are scoped to FRAIM-managed paths.

AI rationale

Evidence

dist/src/cli/setup/claude-code-telemetry.jsdist/src/cli/setup/ide-global-integration.jsdist/src/cli/utils/agent-adapters.js

Network endpoints1

localhost:4318

Decision evidence

public snapshot

AI called this Clean at 84.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares CLI entrypoints and dependencies but no lifecycle script; execution starts through the CLI.
Claude telemetry settings are written by explicit project setup or IDE-add commands and direct metrics to the local receiver.
Agent integration writes FRAIM-named files into existing agent directories or project paths; no unconsented install-time control-surface mutation was identified.
The diagnostics excerpt sanitizes FRAIM tokens; reviewed source did not establish credential theft, destructive behavior, or another attack.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 190 file(s), 1.86 MB of source, external domains: 127.0.0.1, accounts.google.com, ai.google.dev, antigravity.google, api.anthropic.com, api.dicebear.com, api.github.com, api.githubcopilot.com, api.stripe.com, app.seekout.com, cdn.jsdelivr.net, checkout.stripe.com, claude.ai, code.visualstudio.com, cursor.com, design.claude.ai, dev.azure.com, docs.github.com, docs.gitlab.com, docs.microsoft.com, fonts.googleapis.com, fonts.gstatic.com, fraim.wellnessatwork.me, fraimworks.ai, github.com, gitlab.com, hooks.stripe.com, id.atlassian.com, js.stripe.com, kiro.dev, oauth2.googleapis.com, openai.com, support.atlassian.com, support.claude.com, windsurf.com, www.anthropic.com, www.claude.ai, www.fraimworks.ai, www.indeed.com, www.linkedin.com, www.python.org, x.ai

Source & flagged code

19 flagged

dist/src/core/utils/git-utils.jsView file

9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier; L10: const child_process_1 = require("child_process"); L11: function extractLocalFolderLabel(rawPath) {

High

Child Process

Package source references child process execution.

dist/src/core/utils/git-utils.jsView on unpkg · L9

dist/src/cli/doctor/checks/scripts-checks.jsView file

170// Primary probe: py launcher (not subject to App Execution Alias) L171: const pyResult = (0, child_process_1.spawnSync)('py --version', { timeout: 1500, encoding: 'utf8', shell: true }); L172: if (pyResult.status === 0) {

High

Shell

Package source references shell execution.

dist/src/cli/doctor/checks/scripts-checks.jsView on unpkg · L170

14const os_1 = __importDefault(require("os")); L15: const child_process_1 = require("child_process"); L16: const SCRIPTS_DIR = path_1.default.join(os_1.default.homedir(), '.fraim', 'scripts'); L17: /** ... L92: // Skip on Windows L93: if (process.platform === 'win32') { L94: return { ... L172: if (pyResult.status === 0) { L173: const version = (pyResult.stdout || pyResult.stderr || '').trim(); L174: return { ... L191: message: 'Python not available on Windows — Microsoft Store alias detected or Python not installed', L192: suggestion: 'Install Python from https://www.python.org/downloads/windows/ (the official installer registers the py launcher). Python scripts in ~/.fraim/scripts/ will not run unti...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/cli/doctor/checks/scripts-checks.jsView on unpkg · L14

bin/fraim.jsView file

3try { L4: require('../dist/src/cli/fraim.js'); L5: } catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/fraim.jsView on unpkg · L3

dist/src/first-run/session-service.jsView file

44Trigger-reachable persistence chain: manifest.bin -> bin/fraim.js -> dist/src/cli/fraim.js -> dist/src/cli/commands/first-run.js -> dist/src/first-run/session-service.js L44: const crypto_1 = __importDefault(require("crypto")); L45: const child_process_1 = require("child_process"); L46: const ide_detector_1 = require("../cli/setup/ide-detector"); ... L55: function getFakeStateMode() { L56: if (process.env.FRAIM_FIRST_RUN_FAKE !== '1') L57: return null; ... L64: function commandVersion(command, extraBinDirs, basePath) { L65: const executable = process.platform === 'win32' ? 'cmd.exe' : command; L66: const args = process.platform === 'win32' ... L79: return null; L80: const text = `${result.stdout || ''}${result.stderr || ''}`.split(/\r?\n/)[0]?.trim() || null; L81: return text;

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/src/first-run/session-service.jsView on unpkg · L44

44const crypto_1 = __importDefault(require("crypto")); L45: const child_process_1 = require("child_process"); L46: const ide_detector_1 = require("../cli/setup/ide-detector"); ... L55: function getFakeStateMode() { L56: if (process.env.FRAIM_FIRST_RUN_FAKE !== '1') L57: return null; ... L64: function commandVersion(command, extraBinDirs, basePath) { L65: const executable = process.platform === 'win32' ? 'cmd.exe' : command; L66: const args = process.platform === 'win32' ... L79: return null; L80: const text = `${result.stdout || ''}${result.stderr || ''}`.split(/\r?\n/)[0]?.trim() || null; L81: return text;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/src/first-run/session-service.jsView on unpkg · L44

dist/src/cli/setup/user-level-sync.jsView file

128try { L129: (0, child_process_1.execSync)('npm install --no-audit --no-fund --no-save --no-package-lock --omit=dev', { L130: cwd: baseDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/setup/user-level-sync.jsView on unpkg · L128

dist/src/cli/commands/learning-usage.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/cli/commands/learning-usage.js#virtual:normalized:round1View on unpkg

index.jsView file

•matchType = normalized_sha256 matchedPackage = fraim@2.0.183 matchedPath = index.js matchedIdentity = npm:ZnJhaW0:2.0.183 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High