osborn@0.9.156
Voice AI coding assistant - local agent that connects to Osborn frontend
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected sources show a real Voice AI coding assistant with no consumer install hook, but the CLI runtime still pipes a remote install script into a shell, reads Claude session files, and ships a skill that overwrites agent instructions from the network. Incomplete static parse coverage plus that dual-use runtime keep this at a warning rather than a publish block or a clean mark.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user installs the package, then runs the osborn CLI and later starts the IDE or follows bundled skill instructions.
Impact
A running agent can execute the code-server install script, expose an unauthenticated local editor, and read Claude session history.
Mechanism
Remote install-script pipe plus local Claude session and workspace access
AI rationale
Inspected sources show a real Voice AI coding assistant with no consumer install hook, but the CLI runtime still pipes a remote install script into a shell, reads Claude session files, and ships a skill that overwrites agent instructions from the network. Incomplete static parse coverage plus that dual-use runtime keep this at a warning rather than a publish block or a clean mark.
Evidence
dist/index.jsdist/session-access.jsbin/cli.js.claude/skills/voice-native-sync/SKILL.md~/.claude/workspace
Network endpoints4
code-server.dev/install.shwww.voice-native.com/api/sync-skillapi.openai.com/v1/audio/speechus-west-2.recall.ai/api/v1
Decision evidence
public snapshotAI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- When the user starts the IDE, dist/index.js pipes https://code-server.dev/install.sh into sh.
- code-server is spawned with authentication disabled and proxied through the agent HTTP server.
- dist/session-access.js reads full Claude session JSONL and related artifacts under ~/.claude.
- bin/cli.js launches dist/index.js with the inherited process environment.
- A bundled skill tells the agent to overwrite ~/.claude/skills from https://www.voice-native.com/api/sync-skill.
- Background Claude slots run with permissionMode bypassPermissions.
Evidence against
- package.json has no preinstall, install, or postinstall; prepublishOnly only runs the publisher build.
- The package is a user-invoked Voice AI coding assistant CLI, not a library that runs on import.
- Network calls target LiveKit, OpenAI, Groq, Recall.ai, Smithery, and the product frontend rather than a hidden drop host.
- Scanner env-plus-network-plus-spawn flags sit in the same agent runtime because that is the product, not a hidden harvest path.
- Copying process.env into child Claude and code-server processes is local spawn wiring, not a POST of secrets to a third party.
Source & flagged code
9 flagged · loading sourcebin/cli.jsView file
2L3: import { spawn } from 'child_process'
L4: import { fileURLToPath } from 'url'
High
dist/jsonl-search.jsView file
34// @vscode/ripgrep bundles the rg binary — this is our own dependency
L35: const { rgPath } = require('@vscode/ripgrep');
L36: if (rgPath && existsSync(rgPath))
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/jsonl-search.jsView on unpkg · L34dist/index.jsView file
2388const which = await new Promise((res) => {
L2389: const p = spawn('which', ['code-server']);
L2390: let out = '';
...
L2397: await new Promise((res, rej) => {
L2398: const install = spawn('sh', ['-c', 'curl -fsSL https://code-server.dev/install.sh | sh'], {
L2399: env: { ...process.env },
L2400: stdio: ['ignore', 'pipe', 'pipe'],
Findings
5 Critical3 High5 Medium5 Low
CriticalSame File Env Network Executiondist/index.js
CriticalCredential Exfiltrationdist/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalDownload Executedist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processbin/cli.js
HighShell
HighSemantic Analysis Limiteddist/session-access.js#virtual:normalized:round1
MediumDynamic Requiredist/jsonl-search.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdeploy.sh
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to osborn@0.9.156.
See all versions of osborn for other recorded verdicts.
- Review the evidence and your use of osborn@0.9.156 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.