registry / AI-agent capability abuse / fraim / 2.0.290

fraim@2.0.290

FRAIM core CLI and MCP package.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No install lifecycle hook or automatic installation path was found, so the source does not meet the threshold for malicious install-hook abuse. The explicit user-command flow still makes broad agent configuration changes and collects telemetry, which warrants a warning.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

The user runs fraim setup or fraim add-ide, then starts or invokes the FRAIM MCP server.

Impact

Agent-session metadata, token totals, repository identifiers, and the FRAIM API key can be sent to the vendor service; the latest-release launcher adds supply-chain update risk.

Mechanism

Global agent configuration, token-usage collection, and vendor analytics upload.

AI rationale

Evidence

package.jsondist/src/cli/commands/add-ide.jsdist/src/cli/setup/claude-code-telemetry.jsdist/src/cli/setup/ide-global-integration.jsdist/src/local-mcp-server/codex-token-adapter.jsdist/src/local-mcp-server/usage-collector.jsdist/src/cli/mcp/fraim-mcp-latest-launcher.js~/.claude/settings.json~/.claude/skills/fraim/SKILL.md~/.claude/commands/fraim.md~/.codex/skills/fraim/SKILL.md~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl~/.fraim/config.json

Network endpoints3

fraim.wellnessatwork.me/mcp/api/analytics/events

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The explicit add-ide command installs global agent rules and skills after configuring an IDE.
Claude Code setup writes user-level telemetry settings that route metrics to a local receiver.
The MCP server reads the newest Codex session log to collect token totals.
Collected usage events and the FRAIM API key are posted to the vendor analytics endpoint.
A user-level launcher resolves and executes the latest fraim release through npx, creating update-chain risk.

Evidence against

package.json has no preinstall, install, postinstall, or other lifecycle script.
The reviewed configuration and telemetry actions require an explicit FRAIM CLI command or MCP-server start.
The Codex adapter extracts token counters and model data rather than forwarding prompt contents.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

Source & flagged code

16 flagged

dist/src/core/utils/git-utils.jsView file

9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier; L10: const child_process_1 = require("child_process"); L11: function extractLocalFolderLabel(rawPath) {

High

Child Process

Package source references child process execution.

dist/src/core/utils/git-utils.jsView on unpkg · L9

bin/fraim.jsView file

3try { L4: require('../dist/src/cli/fraim.js'); L5: } catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/fraim.jsView on unpkg · L3

dist/src/first-run/session-service.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = fraim@2.0.287 matchedIdentity = npm:ZnJhaW0:2.0.287 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/first-run/session-service.jsView on unpkg

45Trigger-reachable persistence chain: manifest.bin -> bin/fraim.js -> dist/src/cli/fraim.js -> dist/src/cli/commands/setup.js -> dist/src/first-run/session-service.js L45: const crypto_1 = __importDefault(require("crypto")); L46: const child_process_1 = require("child_process"); L47: const ide_detector_1 = require("../cli/setup/ide-detector"); ... L59: function getFakeStateMode() { L60: if (process.env.FRAIM_FIRST_RUN_FAKE !== '1') L61: return null; ... L68: function commandVersion(command, extraBinDirs, basePath) { L69: const executable = process.platform === 'win32' ? 'cmd.exe' : command; L70: const args = process.platform === 'win32' ... L83: return null; L84: const text = `${result.stdout || ''}${result.stderr || ''}`.split(/\r?\n/)[0]?.trim() || null; L85: return text;

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/src/first-run/session-service.jsView on unpkg · L45

45const crypto_1 = __importDefault(require("crypto")); L46: const child_process_1 = require("child_process"); L47: const ide_detector_1 = require("../cli/setup/ide-detector"); ... L59: function getFakeStateMode() { L60: if (process.env.FRAIM_FIRST_RUN_FAKE !== '1') L61: return null; ... L68: function commandVersion(command, extraBinDirs, basePath) { L69: const executable = process.platform === 'win32' ? 'cmd.exe' : command; L70: const args = process.platform === 'win32' ... L83: return null; L84: const text = `${result.stdout || ''}${result.stderr || ''}`.split(/\r?\n/)[0]?.trim() || null; L85: return text;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/src/first-run/session-service.jsView on unpkg · L45

dist/src/cli/doctor/checks/scripts-checks.jsView file

14const os_1 = __importDefault(require("os")); L15: const child_process_1 = require("child_process"); L16: const SCRIPTS_DIR = path_1.default.join(os_1.default.homedir(), '.fraim', 'scripts'); L17: /** ... L92: // Skip on Windows L93: if (process.platform === 'win32') { L94: return { ... L172: if (pyResult.status === 0) { L173: const version = (pyResult.stdout || pyResult.stderr || '').trim(); L174: return { ... L191: message: 'Python not available on Windows — Microsoft Store alias detected or Python not installed', L192: suggestion: 'Install Python from https://www.python.org/downloads/windows/ (the official installer registers the py launcher). Python scripts in ~/.fraim/scripts/ will not run unti...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/cli/doctor/checks/scripts-checks.jsView on unpkg · L14

dist/src/cli/setup/user-level-sync.jsView file

128try { L129: (0, child_process_1.execSync)('npm install --no-audit --no-fund --no-save --no-package-lock --omit=dev', { L130: cwd: baseDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/setup/user-level-sync.jsView on unpkg · L128

index.jsView file

•matchType = normalized_sha256 matchedPackage = fraim@2.0.183 matchedPath = index.js matchedIdentity = npm:ZnJhaW0:2.0.183 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High