
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
███████████ ███████████ █████████ █████
░░███░░░░░░█░░███░░░░░███ ███░░░░░███ ░░███
░███ █ ░ ░███ ░███ ░███ ░███ ░███
░███████ ░██████████ ░███████████ ░███
░███░░░█ ░███░░░░░███ ░███░░░░░███ ░███
░███ ░ ░███ ░███ ░███ ░███ ░███
█████ █████ █████ █████ █████ █████
░░░░░ ░░░░░ ░░░░░ ░░░░░ ░░░░░ ░░░░░
FRAI (Framework of Responsible Artificial Intelligence) is an open-source toolkit that helps any team — from solo developers to compliance officers — ship AI features responsibly. It walks you through quick questions, scans your code, and generates documentation you can actually hand to stakeholders: implementation checklists, model cards, risk files, evaluation reports, and policy-aware RAG indexes.
Think of FRAI as a safety net for AI launches: it collects the right facts, highlights blind spots, and keeps evidence tidy so production reviews stop feeling like guesswork.
1. Install FRAI globally:
npm install -g frai
2. Set up your OpenAI API key (required for AI-powered tips):
frai --setup
You only need to do this once per machine or project. Your key is stored securely and never shared.
3. Run FRAI in your project:
frai
Tip:
fraiis available globally after installing the published npm package. If you're working from a local clone, follow the steps in Local Development to run the CLI from source.
| Command | Description |
|---|---|
frai | Interactive mode for documenting an AI feature (8-question progressive system) |
frai --scan | Scan codebase for AI/ML code and generate docs |
frai --setup | Set up your OpenAI API key (local/global) |
frai --ci | Run in CI mode (non-interactive) |
frai --help, -h | Show help and usage info |
frai --version, -v | Show current version |
frai --update | Check for new versions of FRAI |
frai --list-docs | List generated documentation files |
frai --clean | Remove generated documentation files |
frai --export-pdf | Export documentation markdown files as PDFs |
frai --show-config | Show API key config status |
frai --key=API_KEY | Provide OpenAI API key directly (one-off use) |
frai --global | Use with --setup to save API key globally |
frai rag index | Index compliance docs into a local vector store |
frai eval | Run baseline evaluation metrics and write reports |
frai rag index --input docs/policies --output .frai/compliance-index.json --chunk-size 400
.md, .txt, .json, .yaml files recursively.frai eval --outputs runs/outputs.json --references runs/golden.json --report reports/eval --format markdown
Docs generated:
checklist.md — Implementation checklistmodel_card.md — Model cardrisk_file.md — Risk & compliancefrai/
├─ packages/
│ ├─ frai-cli/ # CLI entry point and command wiring
│ └─ frai-core/ # Reusable services (config, questionnaire, documents, scanners, RAG, eval)
├─ docs/ # Roadmaps, design notes, and feature backlogs
└─ examples/ # Sample AI projects used in tests and demos
FRAI requires an OpenAI API key for generating AI-powered tips and documentation. Run:
frai --setup
If you skip this step, FRAI will prompt you to set up your key on first use.
Run FRAI directly from this repository without publishing:
pnpm install
pnpm --filter frai run build
node packages/frai-cli/dist/index.js --help
node packages/frai-cli/dist/index.js --setup YOUR_KEY
.env:
OPENAI_API_KEY=YOUR_KEY
To test the global binary locally (without npm publishing), install the workspace package:
pnpm install --global ./packages/frai-cli
# then:
frai --setup
Generated by FRAI - Responsible AI in Minutes
FAQs
FRAI - Framework of Responsible Artificial Intelligence
The npm package frai receives a total of 4 weekly downloads. As such, frai popularity was classified as not popular.
We found that frai demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.