osborn@0.9.166
Voice AI coding assistant - local agent that connects to Osborn frontend
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package has no automatic install hook, but its runtime HTTP endpoint is explicitly unauthenticated and can execute a remotely downloaded installer while exposing an unauthenticated workspace IDE.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
An HTTP GET request to /editor while the agent service is running.
Impact
An unauthenticated caller can cause remote code execution through the installer and obtain an IDE session for the workspace.
Mechanism
Unauthenticated endpoint starts a remote shell installer and an authentication-disabled IDE.
AI rationale
The package has no automatic install hook, but its runtime HTTP endpoint is explicitly unauthenticated and can execute a remotely downloaded installer while exposing an unauthenticated workspace IDE.
Evidence
dist/index.js/workspace
Network endpoints1
code-server.dev/install.sh
Decision evidence
public snapshotAI called this Suspicious at 97.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
- The running HTTP service exposes GET /editor without an authentication check; the source labels authentication as future work.
- That endpoint can start an IDE installer which pipes a remote script from code-server.dev directly into sh.
- The installed IDE is launched with authentication disabled for the /workspace directory.
Evidence against
- package.json has only a prepublishOnly hook, so registry installation does not automatically run package code.
- The CLI starts the agent only after an explicit osborn command.
- Recall.ai requests use a configured API key for the package's meeting feature; no credential exfiltration was confirmed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flagged · loading sourcebin/cli.jsView file
2L3: import { spawn } from 'child_process'
L4: import { fileURLToPath } from 'url'
High
dist/jsonl-search.jsView file
34// @vscode/ripgrep bundles the rg binary — this is our own dependency
L35: const { rgPath } = require('@vscode/ripgrep');
L36: if (rgPath && existsSync(rgPath))
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/jsonl-search.jsView on unpkg · L34dist/index.jsView file
2456const which = await new Promise((res) => {
L2457: const p = spawn('which', ['code-server']);
L2458: let out = '';
...
L2465: await new Promise((res, rej) => {
L2466: const install = spawn('sh', ['-c', 'curl -fsSL https://code-server.dev/install.sh | sh'], {
L2467: env: { ...process.env },
L2468: stdio: ['ignore', 'pipe', 'pipe'],
Findings
5 Critical3 High5 Medium5 Low
CriticalSame File Env Network Executiondist/index.js
CriticalCredential Exfiltrationdist/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalDownload Executedist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processbin/cli.js
HighShell
HighSemantic Analysis Limiteddist/session-access.js#virtual:normalized:round1
MediumDynamic Requiredist/jsonl-search.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdeploy.sh
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to osborn@0.9.166.
See all versions of osborn for other recorded verdicts.
- Review the evidence and your use of osborn@0.9.166 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.