Loading npm security reports…

francois@0.37.0: Malicious npm security report (Block) | LPM Firewall

registry / francois / 0.37.0

francois@0.37.0

Mission control for your Claude Code fleet — installs the Francois desktop app without an installer.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

npm postinstall retrieves and installs an opaque native desktop application, then registers it with the user’s operating system. On macOS it also strips quarantine metadata.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through npm runs postinstall automatically.

Impact

An unsigned remote executable is installed and made discoverable or launchable without a separate installer or explicit setup command.

Mechanism

remote native payload installation with security-control bypass and desktop persistence

Attack narrative

During npm installation, package.json invokes install.js. That script constructs a GitHub release URL, downloads and extracts a platform-native archive into vendor, and registers it as a desktop application. On macOS it removes the quarantine attribute from the installed payload. The package’s own source states this route is chosen so unsigned builds that Gatekeeper or SmartScreen would block can launch cleanly.

Rationale

This is an automatic lifecycle-delivered native payload chain that deliberately evades platform download protections and persists through per-user desktop integration. The local hash check does not establish trust in the opaque binary because its expected value is supplied by the same package release.

Evidence

package.jsoninstall.jslib/desktop.jsvendor/vendor/install.json~/Applications/Francois.appHKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\francois~/.local/share/applications/francois.desktop

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

19scripts.postinstall = node install.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L19: const fs = require('node:fs'); L20: const http = require('node:http'); L21: const https = require('node:https'); L22: const os = require('node:os'); L23: const path = require('node:path'); L24: const { spawnSync } = require('node:child_process'); L25: ... L45: L46: const DOWNLOAD_BASE = process.env.FRANCOIS_DOWNLOAD_BASE || 'https://github.com'; L47: const MAX_ATTEMPTS = 3; ... L60: * GitHub redirects release downloads to a CDN, so redirects must be followed. L61: * http is honoured alongside https only so that a self-hosted

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L19

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/francois.jsView file

11L12: const { spawn, spawnSync } = require('node:child_process'); L13: const fs = require('node:fs');

High

Child Process

Package source references child process execution.

bin/francois.jsView on unpkg · L11

11L12: const { spawn, spawnSync } = require('node:child_process'); L13: const fs = require('node:fs'); ... L63: function confirmSync(question) { L64: process.stdout.write(question); L65: const buf = Buffer.alloc(4096); ... L71: } L72: const answer = buf.toString('utf8', 0, bytesRead).trim().toLowerCase(); L73: return answer === 'y' || answer === 'yes'; ... L158: function warnIfWebView2Missing() { L159: if (process.platform !== 'win32') return; L160: const guid = '{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/francois.jsView on unpkg · L11

229const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm'; L230: const result = spawnSync(npmCmd, ['uninstall', '-g', pkg.name], { stdio: 'inherit' }); L231: process.exit(result.status === null ? 1 : result.status); ... L241: } L242: die('the app payload is missing — reinstall with `npm i -g francois`.'); L243: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/francois.jsView on unpkg · L229

install.js#virtual:normalized:round1View file

114} catch { L115: run("powershell", [ L116: "-NoProfile", ... L122: } else { L123: // System tar on macOS/Linux preserves the bundle"s symlinks and exec bits.\n run("tar", ["-xzf", archive, "-C", dest]);\n }\n}\n\nasync function main() {\n if (process.env.FR... L124: // — which skips finally blocks — still clears the staging directory.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.js#virtual:normalized:round1View on unpkg · L114

bin/francois.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/francois.js#virtual:normalized:round1View on unpkg

install.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.36.1 matchedPath = install.js matchedIdentity = npm:ZnJhbmNvaXM:0.36.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.jsView on unpkg

lib/desktop.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.36.1 matchedPath = lib/desktop.js matchedIdentity = npm:ZnJhbmNvaXM:0.36.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/desktop.jsView on unpkg

lib/extensions.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.36.1 matchedPath = lib/extensions.js matchedIdentity = npm:ZnJhbmNvaXM:0.36.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/extensions.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 1-46json

1{

2 "name": "francois",

3 "version": "0.37.0",

4 "description": "Mission control for your Claude Code fleet — installs the Francois desktop app without an installer.",

5 "license": "AGPL-3.0-only",

6 "author": "Antoine Gimenez",

7 "homepage": "https://github.com/antoine-gmnz/francois#readme",

8 "repository": {

9 "type": "git",

10 "url": "git+https://github.com/antoine-gmnz/francois.git",

11 "directory": "packaging/npm"

12 },

13 "bugs": "https://github.com/antoine-gmnz/francois/issues",

14 "keywords": [

15 "claude",

16 "claude-code",

17 "anthropic",

18 "terminal",

19 "tauri",

20 "desktop"

21 ],

22 "bin": {

23 "francois": "bin/francois.js"

24 },

25 "scripts": {

26 "postinstall": "node install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "preuninstall": "node uninstall.js"

28 },

29 "files": [

30 "assets/icon.png",

31 "bin/",

32 "lib/",

33 "!**/*.test.mjs",

34 "install.js",

35 "uninstall.js",

36 "manifest.json",

37 "README.md"

38 ],

39 "engines": {

40 "node": ">=18"

41 },

42 "os": [

43 "darwin",

44 "win32",

45 "linux"

46 ]

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L19

bin/francois.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2'use strict';

3

4/**

5 * `francois` — launch the desktop app that install.js unpacked into vendor/.

6 *

7 * Unrecognised arguments are forwarded to the app binary, so this stays

8 * forward-compatible with the read-only CLI companion (specs/cli-companion.md)

9 * once that ships.

10 */

11

12

install.js#virtual:normalized:round1View file

114} catch { L115: run("powershell", [ L116: "-NoProfile", ... L122: } else { L123: // System tar on macOS/Linux preserves the bundle"s symlinks and exec bits.\n run("tar", ["-xzf", archive, "-C", dest]);\n }\n}\n\nasync function main() {\n if (process.env.FR... L124: // — which skips finally blocks — still clears the staging directory.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.js#virtual:normalized:round1View on unpkg · L114

bin/francois.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/francois.js#virtual:normalized:round1View on unpkg

install.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.36.1 matchedPath = install.js matchedIdentity = npm:ZnJhbmNvaXM:0.36.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.jsView on unpkg

lib/desktop.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.36.1 matchedPath = lib/desktop.js matchedIdentity = npm:ZnJhbmNvaXM:0.36.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/desktop.jsView on unpkg

lib/extensions.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.36.1 matchedPath = lib/extensions.js matchedIdentity = npm:ZnJhbmNvaXM:0.36.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/extensions.jsView on unpkg