fraim@2.0.339
FRAIM core CLI and MCP package.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe source confirms a conditional command injection vulnerability in the project initialization path. It warrants a warning, while the inspected source does not show an automatic install-time trigger or establish malicious intent.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user runs project initialization where configuration is absent, the origin lookup does not return a URL, and a crafted remote is selected by the fallback.
Impact
A crafted repository configuration could execute local commands with the user's privileges.
Mechanism
Git remote output is interpolated into a command executed through `execSync`.
AI rationale
The source confirms a conditional command injection vulnerability in the project initialization path. It warrants a warning, while the inspected source does not show an automatic install-time trigger or establish malicious intent.
Evidence
dist/src/cli/commands/init-project.jsdist/src/cli/utils/platform-detection.js
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- When project configuration is absent, `init-project` calls Git platform detection.
- The fallback builds a shell command using the first configured remote name without escaping it, creating a conditional command injection risk.
- The manifest exposes CLI entry points, and the risky path is reached through project initialization rather than an install hook.
- The inspected agent setup writes FRAIM-specific integration files; the diagnostic helper redacts FRAIM keys, and the session utility spawns commands with shell execution disabled.
Evidence against
- The injection path requires someone to run project initialization and reach the fallback remote lookup; it is not shown as an automatic install-time action.
- The inspected agent integrations and runtime operations do not establish a separate attack surface.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
16 flagged · loading sourcedist/src/core/utils/git-utils.jsView file
9exports.sanitizeRepoIdentifier = sanitizeRepoIdentifier;
L10: const child_process_1 = require("child_process");
L11: function extractLocalFolderLabel(rawPath) {
High
Child Process
Package source references child process execution.
dist/src/core/utils/git-utils.jsView on unpkg · L9dist/src/cli/doctor/checks/scripts-checks.jsView file
235// Primary probe: py launcher (not subject to App Execution Alias)
L236: const pyResult = (0, child_process_1.spawnSync)('py --version', { timeout: 1500, encoding: 'utf8', shell: true, windowsHide: true });
L237: if (pyResult.status === 0) {
High
Shell
Package source references shell execution.
dist/src/cli/doctor/checks/scripts-checks.jsView on unpkg · L235bin/fraim.jsView file
Findings
1 Critical13 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/src/cli/doctor/checks/mcp-connectivity-checks.js
HighChild Processdist/src/core/utils/git-utils.js
HighShelldist/src/cli/doctor/checks/scripts-checks.js
HighSandbox Evasion Gated Capabilitydist/src/cli/commands/override.js
HighTrigger Reachable Persistencedist/src/cli/utils/persist-shell-path.js
HighRuntime Package Installdist/src/cli/setup/user-level-sync.js
HighSemantic Analysis Limiteddist/src/cli/utils/managed-agent-install.js#virtual:normalized:round1
HighKnown Malware Source Similarityindex.js
HighKnown Malware Source Similaritydist/src/cli/commands/override.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to fraim@2.0.339.
See all versions of fraim for other recorded verdicts.
- Review the evidence and your use of fraim@2.0.339 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.