fraim@2.0.297
FRAIM core CLI and MCP package.
AI Security Review
scanned 3d ago · by lpm-firewall-aiSource inspection found user-triggered setup for FRAIM-owned agent integrations, which changes agent configuration and warrants a warning. The inspected source does not establish a concrete malicious action or an automatic npm install-time mutation.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user runs a setup or global sync command, or completes first-run setup.
Impact
These files can affect how supported agents invoke FRAIM; the inspected excerpts do not establish credential exposure or other concrete attack behavior.
Mechanism
The setup writes FRAIM-specific skills, commands, or rules into agent configuration locations.
AI rationale
Source inspection found user-triggered setup for FRAIM-owned agent integrations, which changes agent configuration and warrants a warning. The inspected source does not establish a concrete malicious action or an automatic npm install-time mutation.
Evidence
dist/src/cli/setup/claude-code-telemetry.jsdist/src/cli/setup/ide-global-integration.jsdist/src/cli/utils/agent-adapters.jsdist/src/cli/setup/user-level-sync.jsdist/src/first-run/session-service.js
Decision evidence
public snapshotAI called this Suspicious at 77.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes CLI entrypoints, and the inspected manifest excerpt does not show an install hook.
- The setup code writes FRAIM-specific Claude skill and command files under the user's Claude configuration.
- The adapter paths are named for FRAIM-specific project files, including Cursor, Claude, and Codex.
- The user-level sync path refreshes integration artifacts when the user runs the global sync command.
- First-run setup also installs global rules; this is agent integration setup with a user-level configuration effect.
Evidence against
- The inspected sources show no confirmed credential theft, destructive behavior, or remote code execution.
- The flagged Claude integration files are FRAIM-specific, and global sync is tied to a user-invoked command.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
17 flagged · loading sourcedist/src/core/utils/git-utils.jsView file
9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier;
L10: const child_process_1 = require("child_process");
L11: function extractLocalFolderLabel(rawPath) {
High
Child Process
Package source references child process execution.
dist/src/core/utils/git-utils.jsView on unpkg · L9bin/fraim.jsView file
3try {
L4: require('../dist/src/cli/fraim.js');
L5: } catch (error) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/fraim.jsView on unpkg · L3dist/src/first-run/session-service.jsView file
45Trigger-reachable persistence chain: manifest.bin -> bin/fraim.js -> dist/src/cli/fraim.js -> dist/src/cli/commands/first-run.js -> dist/src/first-run/session-service.js
L45: const crypto_1 = __importDefault(require("crypto"));
L46: const child_process_1 = require("child_process");
L47: const ide_detector_1 = require("../cli/setup/ide-detector");
...
L59: function getFakeStateMode() {
L60: if (process.env.FRAIM_FIRST_RUN_FAKE !== '1')
L61: return null;
...
L68: function commandVersion(command, extraBinDirs, basePath) {
L69: const executable = process.platform === 'win32' ? 'cmd.exe' : command;
L70: const args = process.platform === 'win32'
...
L83: return null;
L84: const text = `${result.stdout || ''}${result.stderr || ''}`.split(/\r?\n/)[0]?.trim() || null;
L85: return text;
Findings
1 Critical14 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/src/local-mcp-server/stdio-server.js
HighChild Processdist/src/core/utils/git-utils.js
HighSandbox Evasion Gated Capabilitydist/src/cli/doctor/checks/scripts-checks.js
HighTrigger Reachable Persistencedist/src/first-run/session-service.js
HighRuntime Package Installdist/src/cli/setup/user-level-sync.js
HighSemantic Analysis Limiteddist/src/cli/utils/pack-home.js#virtual:normalized:round1
HighKnown Malware Source Similarityindex.js
HighKnown Malware Source Similaritydist/src/cli/commands/override.js
HighKnown Malware Source Similaritydist/src/cli/setup/claude-code-telemetry.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to fraim@2.0.297.
See all versions of fraim for other recorded verdicts.
- Review the evidence and your use of fraim@2.0.297 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.