osborn@0.9.220
Voice AI coding assistant - local agent that connects to Osborn frontend
AI Security Review
scanned 27d ago · by lpm-firewall-aiThis is an explicit-command agent-configuration capability that changes a broad user-level Claude control surface. The inspected code does not establish malware or credential theft, so a non-blocking warning is appropriate.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the package entrypoint, causing its Claude LLM module to load.
Impact
This can alter Claude Code behavior and retain Claude credentials on the local machine; no unapproved remote recipient was identified.
Mechanism
Module-load code creates or updates the user's Claude settings; the authentication flow can also store a token after that flow captures one.
AI rationale
This is an explicit-command agent-configuration capability that changes a broad user-level Claude control surface. The inspected code does not establish malware or credential theft, so a non-blocking warning is appropriate.
Evidence
dist/claude-llm.jsdist/claude-auth.jsdist/index.js~/.claude/settings.json~/.claude/.credentials.json~/.claude/.oauth-token
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest exposes command-line entrypoints and shows no install lifecycle hook in the inspected scripts.
- Loading the main program imports the Claude LLM module, whose module-load logic changes Claude settings in the user home directory.
- The LLM module creates or alters global Claude settings, including the context window and cleanup period.
- The authentication flow persists a captured Claude OAuth token into the user's Claude credential location.
- Other inspected integration modules resolve and index Claude session paths under the user's configured Claude directory.
- The recall launcher only spawns the package's own compiled or development recall command.
Evidence against
- No network send operation, remote payload execution, or install-time hook was identified in the inspected paths.
- The observed credential persistence is tied to the Claude authentication flow rather than a demonstrated transfer to another recipient.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
9 flagged · loading sourcebin/recall.jsView file
5L6: import { spawn } from 'child_process'
L7: import { fileURLToPath } from 'url'
High
dist/jsonl-search.jsView file
34// @vscode/ripgrep bundles the rg binary — this is our own dependency
L35: const { rgPath } = require('@vscode/ripgrep');
L36: if (rgPath && existsSync(rgPath))
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/jsonl-search.jsView on unpkg · L34dist/index.jsView file
2453const which = await new Promise((res) => {
L2454: const p = spawn('which', ['code-server']);
L2455: let out = '';
...
L2462: await new Promise((res, rej) => {
L2463: const install = spawn('sh', ['-c', 'curl -fsSL https://code-server.dev/install.sh | sh'], {
L2464: env: { ...process.env },
L2465: stdio: ['ignore', 'pipe', 'pipe'],
Findings
5 Critical3 High5 Medium5 Low
CriticalSame File Env Network Executiondist/index.js
CriticalCredential Exfiltrationdist/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalDownload Executedist/index.js
CriticalPrevious Version Dangerous Deltadist/claude-llm.js
HighChild Processbin/recall.js
HighShell
HighSemantic Analysis Limiteddist/session-access.js#virtual:normalized:round1
MediumDynamic Requiredist/jsonl-search.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdeploy.sh
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to osborn@0.9.220.
See all versions of osborn for other recorded verdicts.
- Review the evidence and your use of osborn@0.9.220 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.