fraim@2.0.351
FRAIM core CLI and MCP package.
AI Security Review
scanned 3d ago · by lpm-firewall-aiExplicit setup commands enable token telemetry by changing user-wide Claude settings, with no separate telemetry confirmation in the inspected path. The receiver is loopback-only and handles usage metrics, so this warrants a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The user runs `fraim init-project` when Claude Code is detected, or configures Claude Code through `add-ide`.
Impact
Claude usage metrics can be collected across projects without a separate telemetry confirmation in the inspected setup path; no credential theft or broader agent control abuse was established.
Mechanism
Setup adds telemetry environment settings to `~/.claude/settings.json` when absent, enabling token metrics to be sent to the local FRAIM receiver.
AI rationale
Explicit setup commands enable token telemetry by changing user-wide Claude settings, with no separate telemetry confirmation in the inspected path. The receiver is loopback-only and handles usage metrics, so this warrants a warning rather than a publish block.
Evidence
dist/src/cli/setup/claude-code-telemetry.jsdist/src/cli/commands/init-project.jsdist/src/cli/commands/add-ide.jsdist/src/local-mcp-server/otlp-metrics-receiver.js~/.claude/settings.json
Network endpoints2
localhost:4318127.0.0.1:${port}
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- `init-project` and Claude Code setup through `add-ide` invoke telemetry configuration; the manifest ends without a scripts section.
- The helper adds missing telemetry settings to `~/.claude/settings.json` and writes the file; the settings enable token telemetry and point to a local receiver.
- `init-project` enables this at the user level, applying it across projects.
- The receiver extracts token counts, cost, session identifiers, and model metadata from metrics.
- The receiver binds to `127.0.0.1`; other inspected integration files install FRAIM-named agent files, while the flagged diagnostic code redacts known secrets and the first-run process uses no shell.
Evidence against
- The inspected telemetry receiver handles usage metrics and listens locally; the inspected path does not establish prompt or credential export to an outside recipient.
- The telemetry mutation is reached through setup commands, not an npm install hook.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
16 flagged · loading sourcedist/registry/scripts/learning/run-publication.jsView file
10const node_path_1 = __importDefault(require("node:path"));
L11: const node_child_process_1 = require("node:child_process");
L12: const proposal_queue_1 = require("./proposal-queue");
High
Child Process
Package source references child process execution.
dist/registry/scripts/learning/run-publication.jsView on unpkg · L10dist/src/cli/doctor/checks/scripts-checks.jsView file
235// Primary probe: py launcher (not subject to App Execution Alias)
L236: const pyResult = (0, child_process_1.spawnSync)('py --version', { timeout: 1500, encoding: 'utf8', shell: true, windowsHide: true });
L237: if (pyResult.status === 0) {
High
Shell
Package source references shell execution.
dist/src/cli/doctor/checks/scripts-checks.jsView on unpkg · L235bin/fraim.jsView file
Findings
1 Critical13 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/src/cli/doctor/checks/mcp-connectivity-checks.js
HighChild Processdist/registry/scripts/learning/run-publication.js
HighShelldist/src/cli/doctor/checks/scripts-checks.js
HighSandbox Evasion Gated Capabilitydist/src/cli/commands/override.js
HighTrigger Reachable Persistencedist/src/cli/utils/persist-shell-path.js
HighRuntime Package Installdist/src/cli/setup/user-level-sync.js
HighSemantic Analysis Limiteddist/src/cli/utils/managed-agent-install.js#virtual:normalized:round1
HighKnown Malware Source Similarityindex.js
HighKnown Malware Source Similaritydist/src/cli/commands/override.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to fraim@2.0.351.
See all versions of fraim for other recorded verdicts.
- Review the evidence and your use of fraim@2.0.351 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.