Loading npm security reports…

francois: Malicious npm security report (Block) | LPM Firewall

registry / francois / 0.62.0

francois@0.62.0

Mission control for your Claude Code fleet — installs the Francois desktop app without an installer.

AI Security Review

scanned 16h ago · by lpm-firewall-ai

The postinstall hook downloads and installs a platform-specific desktop executable. Its source describes avoiding operating-system quarantine checks for unsigned builds.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Package installation runs the postinstall hook.

Impact

An unsigned app is installed through npm without the browser quarantine marker described in the installer comments, reducing an operating-system warning barrier.

Mechanism

The installer fetches a release archive, verifies its checksum, extracts the app, and performs desktop integration; on macOS it also attempts to remove quarantine metadata.

Attack narrative

Installing this package automatically fetches and installs its desktop application. The installer explicitly describes using npm downloads to avoid quarantine attached to browser downloads, and attempts to remove quarantine metadata on macOS. It checks the archive against a packaged checksum, but this does not restore the operating-system warning barrier for the unsigned application.

AI rationale

The automatic postinstall installs an unsigned executable through a path explicitly designed to avoid browser-added quarantine, with additional quarantine removal on macOS. This is concrete install-hook abuse, although the source also verifies the archive against a packaged checksum.

Evidence

package.jsoninstall.js

Network endpoints1

github.com

Decision evidence

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

20scripts.postinstall = node install.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L20: const fs = require('node:fs'); L21: const http = require('node:http'); L22: const https = require('node:https'); L23: const os = require('node:os'); L24: const path = require('node:path'); L25: const { spawnSync } = require('node:child_process'); L26: ... L48: L49: const DOWNLOAD_BASE = process.env.FRANCOIS_DOWNLOAD_BASE || 'https://github.com'; L50: const MAX_ATTEMPTS = 3; ... L63: * GitHub redirects release downloads to a CDN, so redirects must be followed. L64: * http is honoured alongside https only so that a self-hosted

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L20

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/francois.jsView file

11L12: const { spawn, spawnSync } = require('node:child_process'); L13: const fs = require('node:fs');

High

Child Process

Package source references child process execution.

bin/francois.jsView on unpkg · L11

11L12: const { spawn, spawnSync } = require('node:child_process'); L13: const fs = require('node:fs'); ... L63: function confirmSync(question) { L64: process.stdout.write(question); L65: const buf = Buffer.alloc(4096); ... L71: } L72: const answer = buf.toString('utf8', 0, bytesRead).trim().toLowerCase(); L73: return answer === 'y' || answer === 'yes'; ... L158: function warnIfWebView2Missing() { L159: if (process.platform !== 'win32') return; L160: const guid = '{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/francois.jsView on unpkg · L11

229const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm'; L230: const result = spawnSync(npmCmd, ['uninstall', '-g', pkg.name], { stdio: 'inherit' }); L231: process.exit(result.status === null ? 1 : result.status); ... L241: } L242: die('the app payload is missing — reinstall with `npm i -g francois@latest --allowed-scripts=francois`.'); L243: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/francois.jsView on unpkg · L229

install.js#virtual:normalized:round1View file

116} catch { L117: run("powershell", [ L118: "-NoProfile", ... L124: } else { L125: // System tar on macOS/Linux preserves the bundle"s symlinks and exec bits.\n run("tar", ["-xzf", archive, "-C", dest]);\n }\n}\n\n/**\n * An empty directory to unpack into. ve... L126: // — which skips finally blocks — still clears the staging directory.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.js#virtual:normalized:round1View on unpkg · L116

bin/francois.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/francois.js#virtual:normalized:round1View on unpkg

install.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = francois@0.36.3 matchedIdentity = npm:ZnJhbmNvaXM:0.36.3 similarity = 0.429 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

install.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1-46json

1{

2 "name": "francois",

3 "version": "0.62.0",

4 "description": "Mission control for your Claude Code fleet — installs the Francois desktop app without an installer.",

5 "license": "AGPL-3.0-only",

6 "author": "Antoine Gimenez",

7 "homepage": "https://github.com/antoine-gmnz/francois#readme",

8 "repository": {

9 "type": "git",

10 "url": "git+https://github.com/antoine-gmnz/francois.git",

11 "directory": "packaging/npm"

12 },

13 "bugs": "https://github.com/antoine-gmnz/francois/issues",

14 "keywords": [

15 "claude",

16 "claude-code",

17 "anthropic",

18 "terminal",

19 "tauri",

20 "desktop"

21 ],

22 "bin": {

23 "francois": "bin/francois.js"

24 },

25 "scripts": {

26 "postinstall": "node install.js",

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L20

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "preuninstall": "node uninstall.js"

28 },

29 "files": [

30 "assets/icon.png",

31 "bin/",

32 "lib/",

33 "!**/*.test.mjs",

34 "install.js",

35 "uninstall.js",

36 "manifest.json",

37 "README.md"

38 ],

39 "engines": {

40 "node": ">=18"

41 },

42 "os": [

43 "darwin",

44 "win32",

45 "linux"

46 ]

bin/francois.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2'use strict';

3

4/**

5 * `francois` — launch the desktop app that install.js unpacked into vendor/.

6 *

7 * Unrecognised arguments are forwarded to the app binary, so this stays

8 * forward-compatible with the read-only CLI companion (specs/cli-companion.md)

9 * once that ships.

10 */

11

12

install.js#virtual:normalized:round1View file

116} catch { L117: run("powershell", [ L118: "-NoProfile", ... L124: } else { L125: // System tar on macOS/Linux preserves the bundle"s symlinks and exec bits.\n run("tar", ["-xzf", archive, "-C", dest]);\n }\n}\n\n/**\n * An empty directory to unpack into. ve... L126: // — which skips finally blocks — still clears the staging directory.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.js#virtual:normalized:round1View on unpkg · L116

bin/francois.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/francois.js#virtual:normalized:round1View on unpkg

install.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = francois@0.36.3 matchedIdentity = npm:ZnJhbmNvaXM:0.36.3 similarity = 0.429 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

install.jsView on unpkg