Loading npm security reports…

francois@0.35.1: Malicious npm security report (Block) | LPM Firewall

registry / francois / 0.35.1

francois@0.35.1

Mission control for your Claude Code fleet — installs the Francois desktop app without an installer.

AI Security Review

scanned 8h ago · by lpm-firewall-ai

npm postinstall fetches, verifies, extracts, and registers a native desktop binary while intentionally bypassing platform download protections. On macOS it also removes quarantine metadata.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install

Impact

Executes an externally hosted unsigned binary and creates per-user desktop integration.

Mechanism

remote native payload install with SmartScreen/Gatekeeper evasion

Attack narrative

Installing the package runs a postinstall hook that downloads a platform-native archive from GitHub, extracts it, and registers it with the operating system. The source expressly frames npm delivery as a way to avoid SmartScreen and Gatekeeper and additionally strips macOS quarantine metadata. Although it validates the archive against a bundled SHA-256 value, that does not mitigate the intentional security-control bypass or establish trust in the fetched native payload.

Rationale

The source implements an install-time remote native payload chain explicitly designed to evade OS download protections, followed by persistence-like desktop registration. This is concrete malicious install behavior, not merely a normal downloader.

Evidence

package.jsoninstall.jsmanifest.jsonlib/desktop.jslib/platform.jsvendor/~/Applications~/.local/share/applicationsHKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

19scripts.postinstall = node install.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L19: const fs = require('node:fs'); L20: const http = require('node:http'); L21: const https = require('node:https'); L22: const os = require('node:os'); L23: const path = require('node:path'); L24: const { spawnSync } = require('node:child_process'); L25: ... L45: L46: const DOWNLOAD_BASE = process.env.FRANCOIS_DOWNLOAD_BASE || 'https://github.com'; L47: const MAX_ATTEMPTS = 3; ... L60: * GitHub redirects release downloads to a CDN, so redirects must be followed. L61: * http is honoured alongside https only so that a self-hosted

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L19

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/francois.jsView file

11L12: const { spawn, spawnSync } = require('node:child_process'); L13: const fs = require('node:fs');

High

Child Process

Package source references child process execution.

bin/francois.jsView on unpkg · L11

11L12: const { spawn, spawnSync } = require('node:child_process'); L13: const fs = require('node:fs'); ... L63: function confirmSync(question) { L64: process.stdout.write(question); L65: const buf = Buffer.alloc(4096); ... L71: } L72: const answer = buf.toString('utf8', 0, bytesRead).trim().toLowerCase(); L73: return answer === 'y' || answer === 'yes'; ... L158: function warnIfWebView2Missing() { L159: if (process.platform !== 'win32') return; L160: const guid = '{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/francois.jsView on unpkg · L11

229const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm'; L230: const result = spawnSync(npmCmd, ['uninstall', '-g', pkg.name], { stdio: 'inherit' }); L231: process.exit(result.status === null ? 1 : result.status); ... L241: } L242: die('the app payload is missing — reinstall with `npm i -g francois`.'); L243: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/francois.jsView on unpkg · L229

install.js#virtual:normalized:round1View file

114} catch { L115: run("powershell", [ L116: "-NoProfile", ... L122: } else { L123: // System tar on macOS/Linux preserves the bundle"s symlinks and exec bits.\n run("tar", ["-xzf", archive, "-C", dest]);\n }\n}\n\nasync function main() {\n if (process.env.FR... L124: // — which skips finally blocks — still clears the staging directory.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.js#virtual:normalized:round1View on unpkg · L114

install.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.34.0 matchedPath = install.js matchedIdentity = npm:ZnJhbmNvaXM:0.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.jsView on unpkg

lib/desktop.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.34.0 matchedPath = lib/desktop.js matchedIdentity = npm:ZnJhbmNvaXM:0.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/desktop.jsView on unpkg

lib/extensions.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.34.0 matchedPath = lib/extensions.js matchedIdentity = npm:ZnJhbmNvaXM:0.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/extensions.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 1-46json

1{

2 "name": "francois",

3 "version": "0.35.1",

4 "description": "Mission control for your Claude Code fleet — installs the Francois desktop app without an installer.",

5 "license": "AGPL-3.0-only",

6 "author": "Antoine Gimenez",

7 "homepage": "https://github.com/antoine-gmnz/francois#readme",

8 "repository": {

9 "type": "git",

10 "url": "git+https://github.com/antoine-gmnz/francois.git",

11 "directory": "packaging/npm"

12 },

13 "bugs": "https://github.com/antoine-gmnz/francois/issues",

14 "keywords": [

15 "claude",

16 "claude-code",

17 "anthropic",

18 "terminal",

19 "tauri",

20 "desktop"

21 ],

22 "bin": {

23 "francois": "bin/francois.js"

24 },

25 "scripts": {

26 "postinstall": "node install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "preuninstall": "node uninstall.js"

28 },

29 "files": [

30 "assets/icon.png",

31 "bin/",

32 "lib/",

33 "!**/*.test.mjs",

34 "install.js",

35 "uninstall.js",

36 "manifest.json",

37 "README.md"

38 ],

39 "engines": {

40 "node": ">=18"

41 },

42 "os": [

43 "darwin",

44 "win32",

45 "linux"

46 ]

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L19

bin/francois.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2'use strict';

3

4/**

5 * `francois` — launch the desktop app that install.js unpacked into vendor/.

6 *

7 * Unrecognised arguments are forwarded to the app binary, so this stays

8 * forward-compatible with the read-only CLI companion (specs/cli-companion.md)

9 * once that ships.

10 */

11

12

install.js#virtual:normalized:round1View file

114} catch { L115: run("powershell", [ L116: "-NoProfile", ... L122: } else { L123: // System tar on macOS/Linux preserves the bundle"s symlinks and exec bits.\n run("tar", ["-xzf", archive, "-C", dest]);\n }\n}\n\nasync function main() {\n if (process.env.FR... L124: // — which skips finally blocks — still clears the staging directory.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.js#virtual:normalized:round1View on unpkg · L114

install.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.34.0 matchedPath = install.js matchedIdentity = npm:ZnJhbmNvaXM:0.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.jsView on unpkg

lib/desktop.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.34.0 matchedPath = lib/desktop.js matchedIdentity = npm:ZnJhbmNvaXM:0.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/desktop.jsView on unpkg

lib/extensions.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.34.0 matchedPath = lib/extensions.js matchedIdentity = npm:ZnJhbmNvaXM:0.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/extensions.jsView on unpkg