registry / @1interface/voice-core / 0.3.3
@1interface/voice-core@0.3.3
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe unusual postinstall deletion is scoped to nested dependencies and does not form a malicious chain. Shipped runtime code matches the declared voice-client purpose and contains no confirmed attack behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation; user entering voice mode at runtime
Impact
May affect nested dependency layout, but no evidence of exfiltration, persistence, or foreign control-surface mutation.
Mechanism
package-local dependency cleanup and user-invoked WebRTC voice client
AI rationale
The unusual postinstall deletion is scoped to nested dependencies and does not form a malicious chain. Shipped runtime code matches the declared voice-client purpose and contains no confirmed attack behavior.
Evidence
package.jsondist/index.jsdist/index.mjsdist/index.d.tsnode_modules/reactnode_modules/react-dom
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- A postinstall hook removes package-local nested React and React-DOM directories.
Evidence against
- The hook is limited to this package's node_modules paths and has no network, credential, or agent-control action.
- Runtime code is a browser voice/WebRTC client; microphone access is requested through navigator.mediaDevices.
- No shell execution, filesystem harvesting, eval, remote payload loading, persistence, or hard-coded network endpoint was found in shipped entrypoints.
Behavioral surface
Network
MinifiedTrivial
NoLicense
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg59"postinstall": "rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true"
Low
Suspicious Lifecycle Evidence
A postinstall hook removes package-local nested React and React-DOM directories.
package.jsonView on unpkg · L59Findings
1 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @1interface/voice-core@0.3.3.
See all versions of @1interface/voice-core for other recorded verdicts.
- Review the evidence and your use of @1interface/voice-core@0.3.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.