ambiguous@0.9.12
CLI for Ambiguous Workspace — manage docs, tasks, mail, calendar, CRM, and more from the terminal
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe browser-session account-hijack and credential-redirect claims were not confirmed: sign-in is an explicit OAuth flow to the package’s service. However, the CLI silently reports authenticated human-account activity after API commands, which warrants a warning as undisclosed runtime telemetry.
Static reason
No blocking static signals were detected.
Trigger
After a user runs a spec-derived API command while authenticated as a human account.
Impact
The service can observe account activity; no credential theft or account mutation was identified.
Mechanism
The CLI sends an authenticated POST with no custom body to /api/presence/activity.
AI rationale
The browser-session account-hijack and credential-redirect claims were not confirmed: sign-in is an explicit OAuth flow to the package’s service. However, the CLI silently reports authenticated human-account activity after API commands, which warrants a warning as undisclosed runtime telemetry.
Evidence
dist/index.js
Network endpoints2
api.ambiguous.aiapi.devambi.cc
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- After spec-derived API commands, the CLI triggers an activity beacon.
- The beacon sends an authenticated POST to /api/presence/activity when a token is present and the account is human; it skips agent accounts.
- The default API hosts are api.ambiguous.ai and, for staging, api.devambi.cc.
Evidence against
- The beacon sends no custom request body, and it is sent only to the package’s API service.
- Browser sign-in is an explicit auth login flow using the Ambiguous Workspace OAuth service.
- The package is presented as a CLI for managing Ambiguous Workspaces.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicenseWildcardDependency
Source & flagged code
3 flaggeddist/index.jsView file
49* Constructs the CommanderError class
L50: * @param {number} exitCode suggested exit code which could be used with process.exit
L51: * @param {string} code an id string representing the error
...
L1164: var EventEmitter = __require("events").EventEmitter;
L1165: var childProcess2 = __require("child_process");
L1166: var path12 = __require("path");
...
L1214: this._outputConfiguration = {
L1215: writeOut: (str) => process15.stdout.write(str),
L1216: writeErr: (str) => process15.stderr.write(str),
...
L1253: * @returns {Command[]}
L1254: * @private
L1255: */
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/index.jsView on unpkg · L49•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
trigger: "a person approves an OAuth client on the consent screen and its authorization code is written",
name: "API Key Created",
event: "API Key Created",
trigger: "an API key is created in Admin",
trigger: "a live API key is revoked \u2014 a connector disconnected, a key deleted, a Replace applied in the exchange, its agent deleted, an admin revoke, or the client calling `PO...
writeFile: retryify_async_default(promisify(fs.writeFile), RETRYIFY_OPTIONS),
writeFileSync: retryify_sync_default(fs.writeFileSync, RETRYIFY_OPTIONS)
function writeFileSync(filePath, data, options = DEFAULT_WRITE_OPTIONS) {
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
2 High3 Medium7 Low
HighBrowser Session Account Hijackdist/index.js
HighCredential Redirect Persistencedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to ambiguous@0.9.12.
See all versions of ambiguous for other recorded verdicts.
- Review the evidence and your use of ambiguous@0.9.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.