fraim@2.0.329
FRAIM core CLI and MCP package.
AI Security Review
scanned 3d ago · by lpm-firewall-aiSource inspection found no install lifecycle hook or concrete attack behavior in the required flagged paths. The user-invoked setup side effect enables local Claude token metrics and FRAIM-specific agent integration, which is consistent with the package’s CLI and MCP functionality.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user runs FRAIM project initialization or adds Claude Code integration.
Impact
The product can read local Claude token metrics; the inspected behavior does not establish disclosure to an unrelated recipient or unauthorized agent control.
Mechanism
The setup writes missing Claude telemetry settings and FRAIM-specific project integration files; the configured metrics endpoint is localhost.
AI rationale
Source inspection found no install lifecycle hook or concrete attack behavior in the required flagged paths. The user-invoked setup side effect enables local Claude token metrics and FRAIM-specific agent integration, which is consistent with the package’s CLI and MCP functionality.
Evidence
~/.claude/settings.json.cursor/rules/fraim.mdc.claude/commands/fraim.md.claude/skills/fraim/SKILL.md
Network endpoints1
localhost:4318
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines the CLI and dependencies; its inspected manifest contains no install lifecycle scripts.
- Claude telemetry settings are added by CLI setup flows, target a local endpoint, and preserve existing environment values.
- Claude integration files are installed only when the Claude directory exists; agent adapter paths name FRAIM-specific project files.
- The inspected diagnostics, session, git utility, and script-check code covers redaction, session errors, port selection, and static require inspection.
- The remaining flagged code covers local overrides, FRAIM setup artifacts, bounded cleanup, package exports, URL restrictions, workflow discovery, platform detection, secret patterns, cookie formatting, and cached connectivity checks.
Evidence against
- CLI setup enables Claude token telemetry in user-level settings when Claude Code is detected or selected; this is a privacy-relevant product side effect, but the inspected configuration routes metrics to localhost and does not establish an unrelated recipient or attack.
Behavioral surface
Source & flagged code
17 flagged · loading sourcedist/src/core/utils/git-utils.jsView file
9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier;
L10: const child_process_1 = require("child_process");
L11: function extractLocalFolderLabel(rawPath) {
High
Child Process
Package source references child process execution.
dist/src/core/utils/git-utils.jsView on unpkg · L9dist/src/cli/doctor/checks/scripts-checks.jsView file
235// Primary probe: py launcher (not subject to App Execution Alias)
L236: const pyResult = (0, child_process_1.spawnSync)('py --version', { timeout: 1500, encoding: 'utf8', shell: true });
L237: if (pyResult.status === 0) {
High
Shell
Package source references shell execution.
dist/src/cli/doctor/checks/scripts-checks.jsView on unpkg · L235bin/fraim.jsView file
Findings
1 Critical14 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/src/cli/doctor/checks/mcp-connectivity-checks.js
HighChild Processdist/src/core/utils/git-utils.js
HighShelldist/src/cli/doctor/checks/scripts-checks.js
HighSandbox Evasion Gated Capabilitydist/src/cli/commands/override.js
HighTrigger Reachable Persistencedist/src/cli/utils/persist-shell-path.js
HighRuntime Package Installdist/src/cli/setup/user-level-sync.js
HighSemantic Analysis Limiteddist/src/cli/utils/managed-agent-install.js#virtual:normalized:round1
HighKnown Malware Source Similarityindex.js
HighKnown Malware Source Similaritydist/src/cli/commands/override.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to fraim@2.0.329.
See all versions of fraim for other recorded verdicts.
- Review the evidence and your use of fraim@2.0.329 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.