osborn@0.9.227
Voice AI coding assistant - local agent that connects to Osborn frontend
AI Security Review
scanned 26d ago · by lpm-firewall-aiNo malicious install hook or covert payload was found, but the default network exposure and conditionally unauthenticated archive export are a concrete data-exposure vulnerability. The module-load Claude settings change is an additional agent-control-surface concern.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the osborn CLI starts the API server.
Impact
A network-reachable party could retrieve sensitive Claude session material and skills from an unprotected running instance.
Mechanism
The server uses a wildcard CORS policy, binds to 0.0.0.0 by default, and streams an archive of Claude project and skill data when the optional sync token is unset.
AI rationale
No malicious install hook or covert payload was found, but the default network exposure and conditionally unauthenticated archive export are a concrete data-exposure vulnerability. The module-load Claude settings change is an additional agent-control-surface concern.
Evidence
dist/index.jsdist/claude-llm.js
Network endpoints1
0.0.0.0:8741
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
- The CLI launches the compiled agent only when the user runs its command.
- The agent starts an HTTP API on port 8741 during normal startup.
- The API listens on all interfaces by default and permits any web origin.
- Its session export endpoint archives Claude projects and skills, while authentication is enforced only if an optional environment token exists.
- The agent also changes Claude settings at module load.
Evidence against
- No npm install, preinstall, or postinstall hook is declared.
- No hidden outbound secret-transfer sink was identified in the inspected authentication module.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flagged · loading sourcebin/recall.jsView file
5L6: import { spawn } from 'child_process'
L7: import { fileURLToPath } from 'url'
High
dist/jsonl-search.jsView file
34// @vscode/ripgrep bundles the rg binary — this is our own dependency
L35: const { rgPath } = require('@vscode/ripgrep');
L36: if (rgPath && existsSync(rgPath))
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/jsonl-search.jsView on unpkg · L34dist/index.jsView file
2531const which = await new Promise((res) => {
L2532: const p = spawn('which', ['code-server']);
L2533: let out = '';
...
L2540: await new Promise((res, rej) => {
L2541: const install = spawn('sh', ['-c', 'curl -fsSL https://code-server.dev/install.sh | sh'], {
L2542: env: { ...process.env },
L2543: stdio: ['ignore', 'pipe', 'pipe'],
Findings
5 Critical3 High5 Medium5 Low
CriticalSame File Env Network Executiondist/index.js
CriticalCredential Exfiltrationdist/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalDownload Executedist/index.js
CriticalPrevious Version Dangerous Deltadist/claude-llm.js
HighChild Processbin/recall.js
HighShell
HighSemantic Analysis Limiteddist/session-access.js#virtual:normalized:round1
MediumDynamic Requiredist/jsonl-search.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdeploy.sh
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to osborn@0.9.227.
See all versions of osborn for other recorded verdicts.
- Review the evidence and your use of osborn@0.9.227 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.