osborn@0.9.201
Voice AI coding assistant - local agent that connects to Osborn frontend
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is a concrete remote-code-execution and data-exposure vulnerability in a user-run service, but the inspected source does not show covert install-time behavior or a deliberate exfiltration channel. It should be warned and remediated rather than blocked as malware.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Run the osborn CLI, then send a GET request to its exposed /editor or session-export endpoints.
Impact
A reachable attacker could cause remote installer code to run and obtain Claude session data.
Mechanism
Unauthenticated network endpoints trigger remote shell installation and session archive export.
AI rationale
This is a concrete remote-code-execution and data-exposure vulnerability in a user-run service, but the inspected source does not show covert install-time behavior or a deliberate exfiltration channel. It should be warned and remediated rather than blocked as malware.
Evidence
dist/index.js/workspace~/.claude/projects~/.claude/skills
Network endpoints2
0.0.0.0:8741code-server.dev/install.sh
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
- The HTTP server listens on all interfaces and enables permissive cross-origin access.
- An unauthenticated GET to /editor starts the IDE service; the source explicitly says its authentication gate is future work.
- Starting a missing IDE downloads and pipes a remote script into sh.
- The server exposes Claude session exports, and the single-session export has no authorization check.
Evidence against
- The manifest has only a prepublishOnly hook, so registry installation does not run this code.
- The CLI starts the agent only after the user invokes its bin command.
- The OpenRouter call uses a supplied API key for the package's AI feature; no independent credential-sending path was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flagged · loading sourcebin/cli.jsView file
2L3: import { spawn } from 'child_process'
L4: import { fileURLToPath } from 'url'
High
dist/jsonl-search.jsView file
34// @vscode/ripgrep bundles the rg binary — this is our own dependency
L35: const { rgPath } = require('@vscode/ripgrep');
L36: if (rgPath && existsSync(rgPath))
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/jsonl-search.jsView on unpkg · L34dist/index.jsView file
2451const which = await new Promise((res) => {
L2452: const p = spawn('which', ['code-server']);
L2453: let out = '';
...
L2460: await new Promise((res, rej) => {
L2461: const install = spawn('sh', ['-c', 'curl -fsSL https://code-server.dev/install.sh | sh'], {
L2462: env: { ...process.env },
L2463: stdio: ['ignore', 'pipe', 'pipe'],
Findings
5 Critical3 High5 Medium5 Low
CriticalSame File Env Network Executiondist/index.js
CriticalCredential Exfiltrationdist/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalDownload Executedist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processbin/cli.js
HighShell
HighSemantic Analysis Limiteddist/session-access.js#virtual:normalized:round1
MediumDynamic Requiredist/jsonl-search.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdeploy.sh
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to osborn@0.9.201.
See all versions of osborn for other recorded verdicts.
- Review the evidence and your use of osborn@0.9.201 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.