ambiguous@0.9.10
CLI for Ambiguous Workspace — manage docs, tasks, mail, calendar, CRM, and more from the terminal
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe manifest exposes a CLI and has no install lifecycle hook; its prepublishOnly hook performs build and package verification. The flagged browser and credential behavior resolves to user-invoked OAuth and API requests routed through the configured Ambiguous API origin, so the inspected source does not establish an attack.
Decision evidence
public snapshot- package.json exposes a CLI and lists publish-only build hooks, with no install lifecycle hook.
- The bundle sends API and bearer-token requests through the configured API origin; browser sign-in uses OAuth with a local callback.
- The inspected dependency sources provide protocol, terminal styling, and command-line parsing functionality.
Source & flagged code
3 flaggedBrowser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/index.jsView on unpkg · L49Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsFindings
Affected versions and remediation
This report applies to ambiguous@0.9.10.
See all versions of ambiguous for other recorded verdicts.
- Review the evidence and your use of ambiguous@0.9.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.