osborn@0.9.163
Voice AI coding assistant - local agent that connects to Osborn frontend
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo malicious install-time chain or undisclosed credential harvesting was confirmed. However, user-invoked deletion of a Claude directory and runtime remote shell installation create concrete dangerous capability that warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user runs the osborn CLI; the remote installer additionally requires a start-IDE request.
Impact
It can alter the local Claude configuration location, execute code obtained from code-server.dev, and send selected local files to a configured frontend.
Mechanism
Runtime filesystem mutation, shell-based remote installer execution, and configured artifact upload.
AI rationale
No malicious install-time chain or undisclosed credential harvesting was confirmed. However, user-invoked deletion of a Claude directory and runtime remote shell installation create concrete dangerous capability that warrants a warning.
Evidence
bin/cli.jsdist/index.js~/.claude/workspace/.claude
Network endpoints2
code-server.dev/install.sh${FRONTEND_URL}/api/upload
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Running the CLI removes the user's .claude directory and replaces it with a workspace symlink when that workspace path exists.
- The running agent can download and execute the code-server installer through a shell pipeline after a start-IDE request.
- The agent can upload selected local artifacts to a frontend URL supplied through environment configuration.
Evidence against
- The manifest has only a prepublish-only script, so installation does not run package code.
- The download-and-execute path is reached only at runtime through the IDE feature, not during installation.
- The OpenAI and Recall requests use configured service credentials for the stated voice and meeting features.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcebin/cli.jsView file
2L3: import { spawn } from 'child_process'
L4: import { fileURLToPath } from 'url'
High
dist/jsonl-search.jsView file
34// @vscode/ripgrep bundles the rg binary — this is our own dependency
L35: const { rgPath } = require('@vscode/ripgrep');
L36: if (rgPath && existsSync(rgPath))
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/jsonl-search.jsView on unpkg · L34dist/index.jsView file
2456const which = await new Promise((res) => {
L2457: const p = spawn('which', ['code-server']);
L2458: let out = '';
...
L2465: await new Promise((res, rej) => {
L2466: const install = spawn('sh', ['-c', 'curl -fsSL https://code-server.dev/install.sh | sh'], {
L2467: env: { ...process.env },
L2468: stdio: ['ignore', 'pipe', 'pipe'],
Findings
4 Critical3 High5 Medium5 Low
CriticalSame File Env Network Executiondist/index.js
CriticalCredential Exfiltrationdist/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalDownload Executedist/index.js
HighChild Processbin/cli.js
HighShell
HighSemantic Analysis Limiteddist/session-access.js#virtual:normalized:round1
MediumDynamic Requiredist/jsonl-search.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdeploy.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to osborn@0.9.163.
See all versions of osborn for other recorded verdicts.
- Review the evidence and your use of osborn@0.9.163 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.