@1interface/voice-core@0.3.4
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe postinstall deletion is risky and not necessary for normal package runtime behavior, warranting a warning. Source inspection did not establish malicious intent, exfiltration, or remote payload execution.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall; runtime voice connection
Impact
Can break or alter the consumer dependency tree; no confirmed data-exfiltration chain.
Mechanism
install-time recursive dependency deletion; authenticated WebRTC setup
AI rationale
The postinstall deletion is risky and not necessary for normal package runtime behavior, warranting a warning. Source inspection did not establish malicious intent, exfiltration, or remote payload execution.
Evidence
package.jsondist/index.mjsdist/index.jsdist/index.module-S2alA3-r.jsdist/index.module-DCaqEXL5.cjsnode_modules/reactnode_modules/react-dom
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Install-time hook recursively deletes React packages and suppresses errors.
- Runtime code attaches access/device-token headers to a WebRTC ICE request.
Evidence against
- The network action is part of a user-initiated voice/WebRTC connection flow.
- No package-owned credential harvesting, shell execution, remote-code evaluation, or persistence was found in inspected files.
Behavioral surface
Network
MinifiedTrivial
NoLicense
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg59"postinstall": "rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true"
Medium
Ai Review Evidence
Install-time hook recursively deletes React packages and suppresses errors.
package.jsonView on unpkg · L59dist/index.mjsView file
Findings
1 High4 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumAi Review Evidencepackage.json
MediumAi Review Evidencedist/index.mjs
LowScripts Present
LowNo License
Affected versions and remediation
This report applies to @1interface/voice-core@0.3.4.
See all versions of @1interface/voice-core for other recorded verdicts.
- Review the evidence and your use of @1interface/voice-core@0.3.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.