Loading npm security reports…

francois@0.37.1: Malicious npm security report (Block) | LPM Firewall

registry / francois / 0.37.1

francois@0.37.1

Mission control for your Claude Code fleet — installs the Francois desktop app without an installer.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installing the package automatically retrieves an unsigned native application and makes it launchable from user desktop surfaces. The installer deliberately suppresses platform download-security signals.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install runs the postinstall hook.

Impact

A remote native payload is placed in the user environment with OS security warnings bypassed and persistent launch entries created.

Mechanism

Remote native payload installation, quarantine removal, and desktop registration.

Attack narrative

On npm installation, the postinstall script builds a GitHub release URL from its embedded manifest, downloads and extracts a platform archive, and installs it into vendor. It explicitly states that this delivery route avoids SmartScreen and Gatekeeper for an unsigned binary, and it additionally removes macOS quarantine metadata. It then creates per-user desktop integration, including a macOS Applications bundle, Linux desktop entry, or Windows shortcuts and registry entries. The embedded checksum only authenticates the archive against a value controlled by the same published package.

Rationale

This is a lifecycle bootstrapper for a remote unsigned native payload that deliberately bypasses operating-system download protections and persists it in user launch surfaces. The behavior is concrete and automatic at install time.

Evidence

package.jsoninstall.jslib/desktop.jsmanifest.jsonvendor/~/Applications/Francois.app~/.local/share/applications/francois.desktop

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

19scripts.postinstall = node install.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L19: const fs = require('node:fs'); L20: const http = require('node:http'); L21: const https = require('node:https'); L22: const os = require('node:os'); L23: const path = require('node:path'); L24: const { spawnSync } = require('node:child_process'); L25: ... L45: L46: const DOWNLOAD_BASE = process.env.FRANCOIS_DOWNLOAD_BASE || 'https://github.com'; L47: const MAX_ATTEMPTS = 3; ... L60: * GitHub redirects release downloads to a CDN, so redirects must be followed. L61: * http is honoured alongside https only so that a self-hosted

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L19

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/francois.jsView file

11L12: const { spawn, spawnSync } = require('node:child_process'); L13: const fs = require('node:fs');

High

Child Process

Package source references child process execution.

bin/francois.jsView on unpkg · L11

11L12: const { spawn, spawnSync } = require('node:child_process'); L13: const fs = require('node:fs'); ... L63: function confirmSync(question) { L64: process.stdout.write(question); L65: const buf = Buffer.alloc(4096); ... L71: } L72: const answer = buf.toString('utf8', 0, bytesRead).trim().toLowerCase(); L73: return answer === 'y' || answer === 'yes'; ... L158: function warnIfWebView2Missing() { L159: if (process.platform !== 'win32') return; L160: const guid = '{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/francois.jsView on unpkg · L11

229const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm'; L230: const result = spawnSync(npmCmd, ['uninstall', '-g', pkg.name], { stdio: 'inherit' }); L231: process.exit(result.status === null ? 1 : result.status); ... L241: } L242: die('the app payload is missing — reinstall with `npm i -g francois`.'); L243: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/francois.jsView on unpkg · L229

install.js#virtual:normalized:round1View file

114} catch { L115: run("powershell", [ L116: "-NoProfile", ... L122: } else { L123: // System tar on macOS/Linux preserves the bundle"s symlinks and exec bits.\n run("tar", ["-xzf", archive, "-C", dest]);\n }\n}\n\nasync function main() {\n if (process.env.FR... L124: // — which skips finally blocks — still clears the staging directory.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.js#virtual:normalized:round1View on unpkg · L114

bin/francois.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/francois.js#virtual:normalized:round1View on unpkg

install.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.37.0 matchedPath = install.js matchedIdentity = npm:ZnJhbmNvaXM:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.jsView on unpkg

lib/desktop.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.37.0 matchedPath = lib/desktop.js matchedIdentity = npm:ZnJhbmNvaXM:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/desktop.jsView on unpkg

lib/extensions.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.37.0 matchedPath = lib/extensions.js matchedIdentity = npm:ZnJhbmNvaXM:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/extensions.jsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 1-46json

1{

2 "name": "francois",

3 "version": "0.37.1",

4 "description": "Mission control for your Claude Code fleet — installs the Francois desktop app without an installer.",

5 "license": "AGPL-3.0-only",

6 "author": "Antoine Gimenez",

7 "homepage": "https://github.com/antoine-gmnz/francois#readme",

8 "repository": {

9 "type": "git",

10 "url": "git+https://github.com/antoine-gmnz/francois.git",

11 "directory": "packaging/npm"

12 },

13 "bugs": "https://github.com/antoine-gmnz/francois/issues",

14 "keywords": [

15 "claude",

16 "claude-code",

17 "anthropic",

18 "terminal",

19 "tauri",

20 "desktop"

21 ],

22 "bin": {

23 "francois": "bin/francois.js"

24 },

25 "scripts": {

26 "postinstall": "node install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "preuninstall": "node uninstall.js"

28 },

29 "files": [

30 "assets/icon.png",

31 "bin/",

32 "lib/",

33 "!**/*.test.mjs",

34 "install.js",

35 "uninstall.js",

36 "manifest.json",

37 "README.md"

38 ],

39 "engines": {

40 "node": ">=18"

41 },

42 "os": [

43 "darwin",

44 "win32",

45 "linux"

46 ]

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L19

bin/francois.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2'use strict';

3

4/**

5 * `francois` — launch the desktop app that install.js unpacked into vendor/.

6 *

7 * Unrecognised arguments are forwarded to the app binary, so this stays

8 * forward-compatible with the read-only CLI companion (specs/cli-companion.md)

9 * once that ships.

10 */

11

12

install.js#virtual:normalized:round1View file

114} catch { L115: run("powershell", [ L116: "-NoProfile", ... L122: } else { L123: // System tar on macOS/Linux preserves the bundle"s symlinks and exec bits.\n run("tar", ["-xzf", archive, "-C", dest]);\n }\n}\n\nasync function main() {\n if (process.env.FR... L124: // — which skips finally blocks — still clears the staging directory.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.js#virtual:normalized:round1View on unpkg · L114

bin/francois.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/francois.js#virtual:normalized:round1View on unpkg

install.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.37.0 matchedPath = install.js matchedIdentity = npm:ZnJhbmNvaXM:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.jsView on unpkg

lib/desktop.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.37.0 matchedPath = lib/desktop.js matchedIdentity = npm:ZnJhbmNvaXM:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/desktop.jsView on unpkg

lib/extensions.jsView file

•matchType = normalized_sha256 matchedPackage = francois@0.37.0 matchedPath = lib/extensions.js matchedIdentity = npm:ZnJhbmNvaXM:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/extensions.jsView on unpkg