registry / osai-agent / 4.2.65

osai-agent@4.2.65

OS AI Agent - YOUR AI AGENT

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package is a user-invoked AI/sysadmin CLI with powerful but package-aligned local, SSH, file, and network capabilities.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs osai-agent CLI commands such as run, login, connect, provider, or devices.

Impact

Potentially broad user-authorized system changes, but no hidden or install-time malicious behavior identified.

Mechanism

Interactive AI agent tool execution with safety gating

Rationale

Static inspection shows dangerous primitives, but they are the advertised CLI/AI-agent and SSH features, gated by command dispatch, safety checks, and user configuration. I found no lifecycle execution, embedded secret, stealth exfiltration, persistence, or concrete malicious behavior.

Evidence

package.jsonsrc/index.jssrc/services/ssh.jssrc/services/server-url.jssrc/tools/local.jssrc/safety/check.jssrc/agent/loop/tool-executor.jssrc/commands/login.jssrc/commands/run.jssrc/llm/direct.jsConf projectName osai-agent config store~/.osai-agent/todos/*.json

Network endpoints5

wss://OLOJEDE-osai-agent-server.hf.spaceagent.osai.devapi.openai.com/v1api.anthropic.comgenerativelanguage.googleapis.com

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

AI-agent CLI exposes user-invoked local command, file write/delete, SSH exec, browser/search, and websocket tools.
Default service endpoint is wss://OLOJEDE-osai-agent-server.hf.space; some commands also default to https://agent.osai.dev.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks; entrypoint is CLI bin src/index.js.
src/services/ssh.js only validates and uses caller-supplied SSH credentials; no embedded private key or secret found.
src/tools/local.js filters child-process environment to safe keys and applies command safety checks/timeouts.
src/safety/check.js and src/agent/loop/tool-executor.js require confirmation for writes/dangerous actions outside coding auto-approval modes.
Network and LLM endpoints in src/llm/direct.js, src/services/server-url.js, and auth commands are package-aligned user-configured service/API calls.
No source evidence of import-time credential harvesting, persistence, hidden payload download, or unconsented AI-agent control-surface mutation.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 89 file(s), 712 KB of source, external domains: agent.osai.dev, api.anthropic.com, api.cerebras.ai, api.cohere.ai, api.deepinfra.com, api.deepseek.com, api.fireworks.ai, api.groq.com, api.hyperbolic.xyz, api.lingyiwanwu.com, api.mistral.ai, api.moonshot.ai, api.novita.ai, api.openai.com, api.perplexity.ai, api.siliconflow.cn, api.studio.nebius.ai, api.together.ai, api.x.ai, codestral.mistral.ai, dashscope.aliyuncs.com, generativelanguage.googleapis.com, html.duckduckgo.com, integrate.api.nvidia.com, models.github.ai, ollama.com, open.bigmodel.cn, openrouter.ai, osaix.vercel.app, qianfan.baidubce.com, router.huggingface.co

Source & flagged code

7 flagged

src/services/ssh.jsView file

Lines 1-42javascript

1// SSH connection manager

2import { Client } from 'ssh2';

3import { DEFAULTS } from '../utils/constants.js';

4import { logger } from '../utils/logger.js';

6/**

7 * Validate SSH private key format before connection

8 */

9const validateSshPrivateKey = (privateKey) => {

10 if (!privateKey || typeof privateKey !== 'string') {

11 throw new Error('Invalid SSH private key: missing or not a string');

12 }

14 const trimmedKey = privateKey.trim();

16 // Check for common SSH private key headers

17 const validKeyPatterns = [

18 /^-----BEGIN ([A-Z ]+) PRIVATE KEY-----/,

19 /^-----BEGIN OPENSSH PRIVATE KEY-----/,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/services/ssh.jsView on unpkg · L19

Critical

Secret Pattern

OpenSSH private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L19

20 /^-----BEGIN RSA PRIVATE KEY-----/,

Critical

Secret Pattern

RSA private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L20

21 /^-----BEGIN DSA PRIVATE KEY-----/,

22 /^-----BEGIN EC PRIVATE KEY-----/,

Critical

Secret Pattern

EC private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L22

23 /^-----BEGIN ED25519 PRIVATE KEY-----/,

24 /^-----BEGIN ENCRYPTED PRIVATE KEY-----/,

25 ];

27 const isValidFormat = validKeyPatterns.some(pattern => pattern.test(trimmedKey));

29 if (!isValidFormat) {

30 throw new Error('Invalid SSH private key format: must be a valid PEM-formatted private key');

31 }

33 // Check for key footer

34 if (!trimmedKey.includes('-----END')) {

35 throw new Error('Invalid SSH private key: missing END marker');

36 }

38 // Basic length check

39 if (trimmedKey.length < 100) {

40 throw new Error('Invalid SSH private key: too short to be valid');

41 }

src/agent/react-loop.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = osai-agent@4.2.64 matchedIdentity = npm:b3NhaS1hZ2VudA:4.2.64 similarity = 0.989 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/agent/react-loop.jsView on unpkg

src/ui/components/ConfirmationDialog.jsView file

Lines 21-45javascript

21 setValue(v => v + input);

22 }

23 });

25 const isDangerous = details?.isDangerous || details?.tier === 'DANGEROUS';

26 const tool

src/agent/loop/tool-executor.jsView file

Lines 223-263javascript

223

224 // PLAN mode: block any write or dangerous operation

225 if (this.executionMode === EXECUTION_MODES.PLAN) {

226 const planSafety = checkSafety(toolCall, this.mode);

227 if (planSafety.tier !== SAFETY_TIERS

Source & flagged code

7 flagged · loading source

src/services/ssh.jsView file

19patternName = private_key_openssh severity = critical line = 19 matchedText = /^-----B...--/,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/services/ssh.jsView on unpkg · L19

19patternName = private_key_openssh severity = critical line = 19 matchedText = /^-----B...--/,

Critical

Secret Pattern

OpenSSH private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L19

20patternName = private_key_rsa severity = critical line = 20 matchedText = /^-----B...--/,

Critical

Secret Pattern

RSA private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L20

22patternName = private_key_ec severity = critical line = 22 matchedText = /^-----B...--/,

Critical

Secret Pattern

EC private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L22

src/agent/react-loop.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/agent/react-loop.jsView on unpkg

src/ui/components/ConfirmationDialog.jsView file

41patternName = generic_password severity = medium line = 41 matchedText = h(Text, ...')),

Medium

Secret Pattern

Hardcoded password in src/ui/components/ConfirmationDialog.js

src/ui/components/ConfirmationDialog.jsView on unpkg · L41

src/agent/loop/tool-executor.jsView file

243patternName = generic_password severity = medium line = 243 matchedText = this.rea...)));

Medium

Secret Pattern

Hardcoded password in src/agent/loop/tool-executor.js

src/agent/loop/tool-executor.jsView on unpkg · L243

Findings

5 Critical4 Medium5 Low

CriticalCritical Secretsrc/services/ssh.js

CriticalPrevious Version Dangerous Deltasrc/agent/react-loop.js

CriticalSecret Patternsrc/services/ssh.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patternsrc/ui/components/ConfirmationDialog.js

MediumSecret Patternsrc/agent/loop/tool-executor.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

src/services/ssh.jsView file

Lines 1-42javascript

1// SSH connection manager

2import { Client } from 'ssh2';

3import { DEFAULTS } from '../utils/constants.js';

4import { logger } from '../utils/logger.js';

6/**

7 * Validate SSH private key format before connection

8 */

9const validateSshPrivateKey = (privateKey) => {

10 if (!privateKey || typeof privateKey !== 'string') {

11 throw new Error('Invalid SSH private key: missing or not a string');

12 }

14 const trimmedKey = privateKey.trim();

16 // Check for common SSH private key headers

17 const validKeyPatterns = [

18 /^-----BEGIN ([A-Z ]+) PRIVATE KEY-----/,

19 /^-----BEGIN OPENSSH PRIVATE KEY-----/,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/services/ssh.jsView on unpkg · L19

Critical

Secret Pattern

OpenSSH private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L19

20 /^-----BEGIN RSA PRIVATE KEY-----/,

Critical

Secret Pattern

RSA private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L20

21 /^-----BEGIN DSA PRIVATE KEY-----/,

22 /^-----BEGIN EC PRIVATE KEY-----/,

Critical

Secret Pattern

EC private key in src/services/ssh.js

src/services/ssh.jsView on unpkg · L22

23 /^-----BEGIN ED25519 PRIVATE KEY-----/,

24 /^-----BEGIN ENCRYPTED PRIVATE KEY-----/,

25 ];

27 const isValidFormat = validKeyPatterns.some(pattern => pattern.test(trimmedKey));

29 if (!isValidFormat) {

30 throw new Error('Invalid SSH private key format: must be a valid PEM-formatted private key');

31 }

33 // Check for key footer

34 if (!trimmedKey.includes('-----END')) {

35 throw new Error('Invalid SSH private key: missing END marker');

36 }

38 // Basic length check

39 if (trimmedKey.length < 100) {

40 throw new Error('Invalid SSH private key: too short to be valid');

41 }

src/agent/react-loop.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/agent/react-loop.jsView on unpkg

src/ui/components/ConfirmationDialog.jsView file

Lines 21-45javascript

21 setValue(v => v + input);

22 }

23 });

25 const isDangerous = details?.isDangerous || details?.tier === 'DANGEROUS';

26 const tool

src/agent/loop/tool-executor.jsView file

Lines 223-263javascript

223

224 // PLAN mode: block any write or dangerous operation

225 if (this.executionMode === EXECUTION_MODES.PLAN) {

226 const planSafety = checkSafety(toolCall, this.mode);

227 if (planSafety.tier !== SAFETY_TIERS