registry / AI-agent capability abuse / fraim / 2.0.287

fraim@2.0.287

FRAIM core CLI and MCP package.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This package has no install lifecycle hook, so the behavior is not an unconsented install-time compromise. Its explicit sync flow still downloads opaque remote scripts and modifies multiple AI-agent control surfaces, which warrants a warning.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

An explicit fraim sync, setup, add-ide, or first-run command.

Impact

A compromised or malicious FRAIM service could place later-used scripts and influence supported AI-agent invocation surfaces.

Mechanism

Remote content synchronization and agent configuration mutation.

AI rationale

Evidence

package.jsonindex.jsdist/src/cli/commands/sync.jsdist/src/cli/utils/remote-sync.jsdist/src/cli/setup/user-level-sync.jsdist/src/cli/setup/ide-global-integration.js~/.fraim/scripts/~/.fraim/package.json~/.fraim/node_modules/~/.claude/skills/fraim/SKILL.md~/.cursor/rules/fraim.mdc~/.codex/skills/fraim/SKILL.md~/.grok/skills/fraim/SKILL.md~/.gemini/commands/fraim.toml~/.codeium/windsurf/commands/fraim.md~/.kiro/commands/fraim.md

Network endpoints1

fraim.wellnessatwork.me

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The user-invoked sync command downloads a registry payload from the configured FRAIM server.
Sync writes remotely supplied files into the user's FRAIM scripts directory without validating their contents.
Sync creates a user-level package manifest and runs npm install for a runtime dependency.
Sync updates global Claude, Cursor, Codex, Grok, Gemini, Windsurf, and Kiro agent invocation files when their directories exist.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The entrypoints only register and run the CLI after an explicit command.
The agent-control writes are reached through explicit setup or sync actions, not package installation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

11 flagged

dist/src/core/utils/git-utils.jsView file

Lines 1-29javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.isExplicitLocalRepoPath = isExplicitLocalRepoPath;

4exports.getPort = getPort;

5exports.determineDatabaseName = determineDatabaseName;

6exports.getCurrentGitBranch = getCurrentGitBranch;

7exports.determineSchema = determineSchema;

8exports.getDefaultBranch = getDefaultBranch;

9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier;

10const child_process_1 = require("child_process");

11function extractLocalFolderLabel(rawPath) {

High

Child Process

Package source references child process execution.

dist/src/core/utils/git-utils.jsView on unpkg · L9

12 const normalized = rawPath

13 .trim()

14 .replace(/^file:\/\//i, '')

15 .replace(/\\/g, '/')

16 .replace(/\/+$/, '');

17 if (!normalized)

18 return undefined;

19 const parts = normalized.split('/').filter(Boolean);

20 const candidate = parts[parts.length - 1];

21 return candidate || undefined;

22}

23function isExplicitLocalRepoPath(repoUrl) {

24 if (!repoUrl || typeof repoUrl !== 'string') {

25 return false;

26 }

27 const trimmed = repoUrl.trim();

28 return (trimmed.startsWith('/') ||

29 trimmed.startsWith('\\') ||

bin/fraim.jsView file

3try { L4: require('../dist/src/cli/fraim.js'); L5: } catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/fraim.jsView on unpkg · L3

dist/src/first-run/session-service.jsView file

Lines 25-65javascript

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var

dist/src/cli/doctor/checks/scripts-checks.jsView file

Lines 1-34javascript

1"use strict";

2/**

3 * Scripts checks for FRAIM doctor command

4 * Validates user scripts directory and sync status

5 * Issue #144: Enhanced doctor command

6 */

7var __importDefault = (this && this.__importDefault) ||

dist/src/cli/setup/user-level-sync.jsView file

Lines 108-148javascript

108 delete childEnv.NODE_UNIQUE_ID;

109 let pkg = {};

110 if (fs_1.default.existsSync(pkgPath)) {

111 try {

112 pkg = JSON

index.jsView file

•matchType = normalized_sha256 matchedPackage = fraim@2.0.183 matchedPath = index.js matchedIdentity = npm:ZnJhaW0:2.0.183 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High