registry / Install hook abuse / @1interface/voice-core

@1interface/voice-core

This report shows the evidence for @1interface/voice-core@0.6.0. 3 of 18 known versions are blocked or flagged. The newest version, 0.7.1, is allowed. See all versions.

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The package's postinstall hook unconditionally deletes two common consumer dependencies. This is concrete destructive install-time behavior, so the package should be blocked.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the package when npm runs its postinstall hook.

Impact

Removes those dependencies from the consumer's installation.

Mechanism

The hook runs rm -rf against node_modules/react and node_modules/react-dom.

Attack narrative

On installation, the postinstall command removes React and React DOM from node_modules. This is a destructive change to the consumer's dependency tree and can break applications that rely on either package.

AI rationale

The package's postinstall hook unconditionally deletes two common consumer dependencies. This is concrete destructive install-time behavior, so the package should be blocked.

Evidence

package.jsonnode_modules/reactnode_modules/react-dom

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The postinstall hook recursively deletes React and React DOM from the installer's node_modules, changing the consumer's dependency tree during installation.

Evidence against

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsMinifiedTrivialUrlStrings

Manifest

NoLicense

scanned 4 file(s), 203 KB of source, external domains: github.com

Source & flagged code

3 flagged

package.jsonView file

Lines 39-61json

39 "@rollup/plugin-terser": "^1.0.0",

40 "@testing-library/jest-dom": "^6.9.1",

41 "@testing-library/react": "^16.3.2",

42 "@types/node": "^24.12.4",

43 "@types/react": "^19.2.15",

44 "@types/react-dom": "^19.2.3",

45 "@vitejs/plugin-react": "5.1.1",

46 "@vitest/ui": "4.1.0",

47 "jsdom": "^27.4.0",

48 "terser": "5.46.1",

49 "typescript": "~5.9.3",

50 "vite": "7.3.2",

51 "vite-plugin-dts": "^4.5.4",

52 "vitest": "4.1.0"

53 },

54 "scripts": {

55 "build": "vite build",

56 "dev": "vite build --watch",

57 "test": "vitest",

58 "test:ui": "vitest --ui",

59 "postinstall": "rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L59

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L59

60 }

61}

High

Suspicious Lifecycle Evidence

The postinstall hook recursively deletes React and React DOM from the installer's node_modules, changing the consumer's dependency tree during installation.

package.jsonView on unpkg · L59

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

59"postinstall": "rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true" } }

High

Suspicious Lifecycle Evidence

The postinstall hook recursively deletes React and React DOM from the installer's node_modules, changing the consumer's dependency tree during installation.

package.jsonView on unpkg · L59

•scripts.postinstall = rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

2 High2 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @1interface/voice-core@0.6.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @1interface/voice-core@0.6.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-10 03:23:24.802Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

18 known versions

0.7.1latestClean—AllowPublishedOct 16, 2026, 1:47 PM 0.7.0Clean—AllowPublishedOct 14, 2026, 7:05 AM 0.6.2SuspiciousDestructive ActionWarnPublishedOct 13, 2026, 5:44 AM 0.6.1Clean—AllowPublishedSep 30, 2026, 9:01 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @1interface

Other install hook abuse packages

Behavioral surface

Source & flagged code

Related packages

More from @1interface

Other install hook abuse packages