fraim@2.0.303
FRAIM core CLI and MCP package.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe manifest declares CLI entrypoints without npm lifecycle scripts or a runtime self-dependency. The inspected settings changes are activated by setup commands and direct token metrics to a loopback receiver; source inspection did not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The telemetry settings are added when a user runs add-ide or init-project; FRAIM agent files are installed during setup or a user-run global sync.
Impact
The reviewed telemetry path sends metrics to a local receiver; no confirmed attack surface was established.
Mechanism
Setup adds missing Claude Code metrics settings pointed at localhost:4318. The receiver listens on 127.0.0.1, while agent invocation files are FRAIM-specific and project adapters are confined to the project root.
AI rationale
The manifest declares CLI entrypoints without npm lifecycle scripts or a runtime self-dependency. The inspected settings changes are activated by setup commands and direct token metrics to a loopback receiver; source inspection did not establish malicious behavior.
Evidence
~/.claude/settings.json~/.claude/skills/fraim/SKILL.md~/.claude/commands/fraim.md.cursor/rules/fraim.mdc.claude/commands/fraim.md.claude/skills/fraim/SKILL.md.github/prompts/fraim.prompt.md
Network endpoints1
localhost:4318
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes CLI entrypoints and contains no lifecycle scripts or runtime dependency on fraim.
- Claude Code setup adds missing token-metrics settings pointed at a loopback receiver; explicit CLI setup commands activate the helper.
- Agent setup installs FRAIM-specific files, and the project adapter helper confines writes to the project root.
- The diagnostics helper redacts known secrets and FRAIM tokens from returned text.
- The other inspected paths implement CLI, repository, marketplace, cookie, installer, and connectivity functions; they did not establish an attack.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
17 flagged · loading sourcedist/src/core/utils/git-utils.jsView file
9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier;
L10: const child_process_1 = require("child_process");
L11: function extractLocalFolderLabel(rawPath) {
High
Child Process
Package source references child process execution.
dist/src/core/utils/git-utils.jsView on unpkg · L9bin/fraim.jsView file
3try {
L4: require('../dist/src/cli/fraim.js');
L5: } catch (error) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/fraim.jsView on unpkg · L3dist/src/first-run/session-service.jsView file
46Trigger-reachable persistence chain: manifest.bin -> bin/fraim.js -> dist/src/cli/fraim.js -> dist/src/cli/commands/first-run.js -> dist/src/first-run/session-service.js
L46: const crypto_1 = __importDefault(require("crypto"));
L47: const child_process_1 = require("child_process");
L48: const ide_detector_1 = require("../cli/setup/ide-detector");
...
L60: function getFakeStateMode() {
L61: if (process.env.FRAIM_FIRST_RUN_FAKE !== '1')
L62: return null;
...
L69: function commandVersion(command, extraBinDirs, basePath) {
L70: const executable = process.platform === 'win32' ? 'cmd.exe' : command;
L71: const args = process.platform === 'win32'
...
L85: return null;
L86: return (0, managed_agent_paths_1.versionFromProbeOutput)(result.stdout, result.stderr);
L87: }
Findings
1 Critical14 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/src/cli/doctor/checks/mcp-connectivity-checks.js
HighChild Processdist/src/core/utils/git-utils.js
HighSandbox Evasion Gated Capabilitydist/src/cli/doctor/checks/scripts-checks.js
HighTrigger Reachable Persistencedist/src/first-run/session-service.js
HighRuntime Package Installdist/src/cli/setup/user-level-sync.js
HighSemantic Analysis Limiteddist/src/cli/utils/managed-agent-paths.js#virtual:normalized:round1
HighKnown Malware Source Similarityindex.js
HighKnown Malware Source Similaritydist/src/cli/commands/override.js
HighKnown Malware Source Similaritydist/src/cli/setup/claude-code-telemetry.js
High
Affected versions and remediation
This report applies to fraim@2.0.303.
See all versions of fraim for other recorded verdicts.
- Review the evidence and your use of fraim@2.0.303 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.