osborn@0.9.169
Voice AI coding assistant - local agent that connects to Osborn frontend
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete remotely reachable data-exposure vulnerability in a user-invoked service, not evidence of an automatic malicious install chain. The absence of install hooks prevents a publish block, but the exposed session archives warrant a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the osborn CLI and the service is reachable over the network.
Impact
Remote disclosure of conversation content, tool outputs, project paths, and learned skills.
Mechanism
Unauthenticated HTTP endpoints enumerate and archive Claude session data.
AI rationale
This is a concrete remotely reachable data-exposure vulnerability in a user-invoked service, not evidence of an automatic malicious install chain. The absence of install hooks prevents a publish block, but the exposed session archives warrant a warning.
Evidence
dist/index.js~/.claude/projects~/.claude/skills
Network endpoints1
0.0.0.0
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
- The runtime server permits every web origin and defaults to binding on all interfaces.
- An unauthenticated session-list endpoint discloses session IDs, paths, and last messages.
- The export-one endpoint uses those IDs to archive Claude session files without authentication.
- The full export is also unauthenticated unless an optional environment token is configured.
Evidence against
- The manifest has only a prepublish hook, not an install-time lifecycle hook.
- The main program starts only through the user-invoked CLI.
- The observed OpenAI request is a TTS request using the configured API key, not credential harvesting.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcebin/cli.jsView file
2L3: import { spawn } from 'child_process'
L4: import { fileURLToPath } from 'url'
High
dist/jsonl-search.jsView file
34// @vscode/ripgrep bundles the rg binary — this is our own dependency
L35: const { rgPath } = require('@vscode/ripgrep');
L36: if (rgPath && existsSync(rgPath))
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/jsonl-search.jsView on unpkg · L34dist/index.jsView file
2459const which = await new Promise((res) => {
L2460: const p = spawn('which', ['code-server']);
L2461: let out = '';
...
L2468: await new Promise((res, rej) => {
L2469: const install = spawn('sh', ['-c', 'curl -fsSL https://code-server.dev/install.sh | sh'], {
L2470: env: { ...process.env },
L2471: stdio: ['ignore', 'pipe', 'pipe'],
Findings
4 Critical3 High5 Medium5 Low
CriticalSame File Env Network Executiondist/index.js
CriticalCredential Exfiltrationdist/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalDownload Executedist/index.js
HighChild Processbin/cli.js
HighShell
HighSemantic Analysis Limiteddist/session-access.js#virtual:normalized:round1
MediumDynamic Requiredist/jsonl-search.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdeploy.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to osborn@0.9.169.
See all versions of osborn for other recorded verdicts.
- Review the evidence and your use of osborn@0.9.169 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.