ambiguous@0.9.8
CLI for Ambiguous Workspace — manage docs, tasks, mail, calendar, CRM, and more from the terminal
AI Security Review
scanned 19d ago · by lpm-firewall-aiThis is conditional credential exposure: AMBI_API_URL is unrestricted, and the shared request client forwards existing bearer tokens, including in an activity beacon. The default is the product API and selecting another base requires configuration, so warn rather than block.
Static reason
No blocking static signals were detected.
Trigger
Set AMBI_API_URL to another host and run an authenticated API command; human account activity can also trigger the beacon.
Impact
The configured recipient can obtain a valid account token and may be able to use the associated account.
Mechanism
The CLI builds request URLs from the configured base and adds the existing token as a bearer credential without checking the destination host.
AI rationale
This is conditional credential exposure: AMBI_API_URL is unrestricted, and the shared request client forwards existing bearer tokens, including in an activity beacon. The default is the product API and selecting another base requires configuration, so warn rather than block.
Evidence
dist/index.js
Network endpoints2
api.ambiguous.aiapi.devambi.cc
Decision evidence
public snapshotAI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- AMBI_API_URL replaces the API base URL without host validation; the default is the product API.
- The CLI can load a token from the environment or saved local, global, and legacy configuration, then build authenticated requests using that base URL.
- Authenticated requests attach the token as a bearer credential and send it to the constructed URL.
- Human account activity triggers a background beacon through the same authenticated request path.
- The user-invoked whoami command also sends the current token to the selected API base.
Evidence against
- The default API base is the package’s product API; the source does not choose an unrelated recipient by default.
- Using an alternate API base requires configuring AMBI_API_URL or the CLI’s API URL setting.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStrings
Source & flagged code
3 flaggeddist/index.jsView file
49* Constructs the CommanderError class
L50: * @param {number} exitCode suggested exit code which could be used with process.exit
L51: * @param {string} code an id string representing the error
...
L1164: var EventEmitter = __require("events").EventEmitter;
L1165: var childProcess2 = __require("child_process");
L1166: var path12 = __require("path");
...
L1214: this._outputConfiguration = {
L1215: writeOut: (str) => process15.stdout.write(str),
L1216: writeErr: (str) => process15.stderr.write(str),
...
L1253: * @returns {Command[]}
L1254: * @private
L1255: */
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/index.jsView on unpkg · L49•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
trigger: "a person approves an OAuth client on the consent screen and its authorization code is written",
API_KEY_CREATED = "API Key Created";
{ event: API_KEY_CREATED, module: "admin", owner: "platform", properties: [], ppiPosture: "none", description: "An API key was created" },
writeFile: retryify_async_default(promisify(fs.writeFile), RETRYIFY_OPTIONS),
writeFileSync: retryify_sync_default(fs.writeFileSync, RETRYIFY_OPTIONS)
function writeFileSync(filePath, data, options = DEFAULT_WRITE_OPTIONS) {
return writeFileSync(filePath, data, { encoding: options });
fs2.writeFileSync(this.path, data, { mode: this.#options.con
High
Credential Redirect Persistence
Findings
2 High3 Medium7 Low
HighBrowser Session Account Hijackdist/index.js
HighCredential Redirect Persistencedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to ambiguous@0.9.8.
See all versions of ambiguous for other recorded verdicts.
- Review the evidence and your use of ambiguous@0.9.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.