registry / fraim / 2.0.280

fraim@2.0.280

FRAIM core CLI and MCP package.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

Source inspection found no install hook, runtime self-dependency, or concrete malicious behavior. The flagged global telemetry change is reachable through explicit setup commands and sends metrics to a loopback receiver.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user runs add-ide or init-project and Claude Code is detected.

Impact

The inspected behavior collects token metrics locally. No external credential or prompt transfer was identified.

Mechanism

Setup adds missing telemetry variables to the user-level Claude settings; the receiver binds to 127.0.0.1.

AI rationale

Evidence

~/.claude/settings.json

Network endpoints2

localhost:4318127.0.0.1

Decision evidence

public snapshot

AI called this Clean at 80.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json identifies the CLI and has no lifecycle script; its dependency list does not include fraim.
Claude token telemetry is enabled only through the add-ide and init-project setup paths; it writes metrics settings to ~/.claude/settings.json and uses a localhost endpoint.
The IDE integration paths install FRAIM-named skills and commands, and the metrics receiver listens on loopback.
The inspected diagnostics and other flagged utilities show secret sanitization, repository validation, setup, syncing, and product service behavior.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 193 file(s), 1.90 MB of source, external domains: 127.0.0.1, accounts.google.com, ai.google.dev, antigravity.google, api.anthropic.com, api.dicebear.com, api.github.com, api.githubcopilot.com, api.stripe.com, app.seekout.com, cdn.jsdelivr.net, checkout.stripe.com, claude.ai, code.visualstudio.com, cursor.com, design.claude.ai, dev.azure.com, docs.github.com, docs.gitlab.com, docs.microsoft.com, fonts.googleapis.com, fonts.gstatic.com, fraim.wellnessatwork.me, fraimworks.ai, github.com, gitlab.com, hooks.stripe.com, id.atlassian.com, js.stripe.com, kiro.dev, oauth2.googleapis.com, openai.com, support.atlassian.com, support.claude.com, windsurf.com, www.anthropic.com, www.claude.ai, www.fraimworks.ai, www.indeed.com, www.linkedin.com, www.python.org, x.ai

Source & flagged code

19 flagged

dist/src/core/utils/git-utils.jsView file

9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier; L10: const child_process_1 = require("child_process"); L11: function extractLocalFolderLabel(rawPath) {

High

Child Process

Package source references child process execution.

dist/src/core/utils/git-utils.jsView on unpkg · L9

dist/src/cli/doctor/checks/scripts-checks.jsView file

170// Primary probe: py launcher (not subject to App Execution Alias) L171: const pyResult = (0, child_process_1.spawnSync)('py --version', { timeout: 1500, encoding: 'utf8', shell: true }); L172: if (pyResult.status === 0) {

High

Shell

Package source references shell execution.

dist/src/cli/doctor/checks/scripts-checks.jsView on unpkg · L170

14const os_1 = __importDefault(require("os")); L15: const child_process_1 = require("child_process"); L16: const SCRIPTS_DIR = path_1.default.join(os_1.default.homedir(), '.fraim', 'scripts'); L17: /** ... L92: // Skip on Windows L93: if (process.platform === 'win32') { L94: return { ... L172: if (pyResult.status === 0) { L173: const version = (pyResult.stdout || pyResult.stderr || '').trim(); L174: return { ... L191: message: 'Python not available on Windows — Microsoft Store alias detected or Python not installed', L192: suggestion: 'Install Python from https://www.python.org/downloads/windows/ (the official installer registers the py launcher). Python scripts in ~/.fraim/scripts/ will not run unti...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/cli/doctor/checks/scripts-checks.jsView on unpkg · L14

bin/fraim.jsView file

3try { L4: require('../dist/src/cli/fraim.js'); L5: } catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/fraim.jsView on unpkg · L3

dist/src/first-run/session-service.jsView file

45Trigger-reachable persistence chain: manifest.bin -> bin/fraim.js -> dist/src/cli/fraim.js -> dist/src/cli/commands/first-run.js -> dist/src/first-run/session-service.js L45: const crypto_1 = __importDefault(require("crypto")); L46: const child_process_1 = require("child_process"); L47: const ide_detector_1 = require("../cli/setup/ide-detector"); ... L57: function getFakeStateMode() { L58: if (process.env.FRAIM_FIRST_RUN_FAKE !== '1') L59: return null; ... L66: function commandVersion(command, extraBinDirs, basePath) { L67: const executable = process.platform === 'win32' ? 'cmd.exe' : command; L68: const args = process.platform === 'win32' ... L81: return null; L82: const text = `${result.stdout || ''}${result.stderr || ''}`.split(/\r?\n/)[0]?.trim() || null; L83: return text;

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/src/first-run/session-service.jsView on unpkg · L45

45const crypto_1 = __importDefault(require("crypto")); L46: const child_process_1 = require("child_process"); L47: const ide_detector_1 = require("../cli/setup/ide-detector"); ... L57: function getFakeStateMode() { L58: if (process.env.FRAIM_FIRST_RUN_FAKE !== '1') L59: return null; ... L66: function commandVersion(command, extraBinDirs, basePath) { L67: const executable = process.platform === 'win32' ? 'cmd.exe' : command; L68: const args = process.platform === 'win32' ... L81: return null; L82: const text = `${result.stdout || ''}${result.stderr || ''}`.split(/\r?\n/)[0]?.trim() || null; L83: return text;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/src/first-run/session-service.jsView on unpkg · L45

dist/src/cli/setup/user-level-sync.jsView file

128try { L129: (0, child_process_1.execSync)('npm install --no-audit --no-fund --no-save --no-package-lock --omit=dev', { L130: cwd: baseDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/setup/user-level-sync.jsView on unpkg · L128

dist/src/cli/commands/learning-usage.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/cli/commands/learning-usage.js#virtual:normalized:round1View on unpkg

index.jsView file

•matchType = normalized_sha256 matchedPackage = fraim@2.0.183 matchedPath = index.js matchedIdentity = npm:ZnJhaW0:2.0.183 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High