Loading npm security reports…

francois@0.18.3: Malicious npm security report (Block) | LPM Firewall

registry / francois / 0.18.3

francois@0.18.3

Mission control for your Claude Code fleet — installs the Francois desktop app without an installer.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Automatic install-time delivery of an unsigned native application designed to evade browser-origin security controls. The payload is persisted and registered with OS launch surfaces.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install runs the postinstall hook.

Impact

Executes a remotely hosted native application after installation and makes it discoverable through desktop integration.

Mechanism

download, checksum-verify, unpack, de-quarantine, and register native payload

Attack narrative

On npm postinstall, the package fetches a platform-native archive from GitHub, verifies only a package-bundled digest, extracts it, and on macOS removes quarantine metadata. It then registers the resulting app in user desktop/OS integration surfaces. Its own source states that the npm path is intended to avoid SmartScreen and Gatekeeper checks for unsigned builds.

Rationale

The automatic native-payload install is explicitly designed to bypass host download-security controls, then persists the payload through OS integration. Digest checking does not mitigate the package author’s intentional delivery of that unsigned payload.

Evidence

package.jsoninstall.jsmanifest.jsonlib/desktop.jslib/platform.jsvendor/~/Applications~/.local/share/applications~/.local/share/iconsHKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

19scripts.postinstall = node install.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L19: const fs = require('node:fs'); L20: const http = require('node:http'); L21: const https = require('node:https'); L22: const os = require('node:os'); L23: const path = require('node:path'); L24: const { spawnSync } = require('node:child_process'); L25: ... L45: L46: const DOWNLOAD_BASE = process.env.FRANCOIS_DOWNLOAD_BASE || 'https://github.com'; L47: const MAX_ATTEMPTS = 3; ... L60: * GitHub redirects release downloads to a CDN, so redirects must be followed. L61: * http is honoured alongside https only so that a self-hosted

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L19

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/francois.jsView file

11L12: const { spawn, spawnSync } = require('node:child_process'); L13: const path = require('node:path');

High

Child Process

Package source references child process execution.

bin/francois.jsView on unpkg · L11

11L12: const { spawn, spawnSync } = require('node:child_process'); L13: const path = require('node:path'); ... L38: function die(message) { L39: process.stderr.write(`\nfrancois: ${message}\n\n`); L40: process.exit(1); ... L49: function warnIfWebView2Missing() { L50: if (process.platform !== 'win32') return; L51: const guid = '{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}'; ... L61: 'francois: the Microsoft Edge WebView2 runtime was not found — the window may fail to open.\n' + L62: ' Install it from https://developer.microsoft.com/microsoft-edge/webview2/\n', L63: );

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/francois.jsView on unpkg · L11

113const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm'; L114: const result = spawnSync(npmCmd, ['uninstall', '-g', pkg.name], { stdio: 'inherit' }); L115: process.exit(result.status === null ? 1 : result.status); ... L125: } L126: die('the app payload is missing — reinstall with `npm i -g francois`.'); L127: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/francois.jsView on unpkg · L113

install.js#virtual:normalized:round1View file

114} catch { L115: run("powershell", [ L116: "-NoProfile", ... L122: } else { L123: // System tar on macOS/Linux preserves the bundle"s symlinks and exec bits.\n run("tar", ["-xzf", archive, "-C", dest]);\n }\n}\n\nasync function main() {\n if (process.env.FR... L124: // — which skips finally blocks — still clears the staging directory.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.js#virtual:normalized:round1View on unpkg · L114

install.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.18.0 matchedPath = install.js matchedIdentity = npm:ZnJhbmNvaXM:0.18.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.jsView on unpkg

lib/desktop.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.18.0 matchedPath = lib/desktop.js matchedIdentity = npm:ZnJhbmNvaXM:0.18.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/desktop.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 1-46json

1{

2 "name": "francois",

3 "version": "0.18.3",

4 "description": "Mission control for your Claude Code fleet — installs the Francois desktop app without an installer.",

5 "license": "AGPL-3.0-only",

6 "author": "Antoine Gimenez",

7 "homepage": "https://github.com/antoine-gmnz/francois#readme",

8 "repository": {

9 "type": "git",

10 "url": "git+https://github.com/antoine-gmnz/francois.git",

11 "directory": "packaging/npm"

12 },

13 "bugs": "https://github.com/antoine-gmnz/francois/issues",

14 "keywords": [

15 "claude",

16 "claude-code",

17 "anthropic",

18 "terminal",

19 "tauri",

20 "desktop"

21 ],

22 "bin": {

23 "francois": "bin/francois.js"

24 },

25 "scripts": {

26 "postinstall": "node install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "preuninstall": "node uninstall.js"

28 },

29 "files": [

30 "assets/icon.png",

31 "bin/",

32 "lib/desktop.js",

33 "lib/platform.js",

34 "install.js",

35 "uninstall.js",

36 "manifest.json",

37 "README.md"

38 ],

39 "engines": {

40 "node": ">=18"

41 },

42 "os": [

43 "darwin",

44 "win32",

45 "linux"

46 ]

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L19

bin/francois.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2'use strict';

3

4/**

5 * `francois` — launch the desktop app that install.js unpacked into vendor/.

6 *

7 * Unrecognised arguments are forwarded to the app binary, so this stays

8 * forward-compatible with the read-only CLI companion (specs/cli-companion.md)

9 * once that ships.

10 */

11

12

install.js#virtual:normalized:round1View file

114} catch { L115: run("powershell", [ L116: "-NoProfile", ... L122: } else { L123: // System tar on macOS/Linux preserves the bundle"s symlinks and exec bits.\n run("tar", ["-xzf", archive, "-C", dest]);\n }\n}\n\nasync function main() {\n if (process.env.FR... L124: // — which skips finally blocks — still clears the staging directory.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.js#virtual:normalized:round1View on unpkg · L114

install.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.18.0 matchedPath = install.js matchedIdentity = npm:ZnJhbmNvaXM:0.18.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.jsView on unpkg

lib/desktop.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.18.0 matchedPath = lib/desktop.js matchedIdentity = npm:ZnJhbmNvaXM:0.18.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/desktop.jsView on unpkg