@1interface/voice-core@0.5.5
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe lifecycle hook is a narrowly scoped cleanup of package-local React copies, consistent with the package’s peer dependency setup and external React imports. The inspected runtime network use fetches the shared-core ICE endpoint with shared-core headers; no concrete attack behavior was identified.
Decision evidence
public snapshot- The postinstall hook removes React packages from this package’s own node_modules directory, while React and React DOM are declared as peer dependencies.
- The published module imports React and React Redux as external packages, consistent with avoiding package-local peer copies.
- The voice module’s ICE request uses a shared-core endpoint and headers as part of its runtime functionality.
Source & flagged code
6 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe postinstall hook removes React packages from this package’s own node_modules directory, while React and React DOM are declared as peer dependencies.
package.jsonView on unpkg · L59Findings
Affected versions and remediation
This report applies to @1interface/voice-core@0.5.5.
See all versions of @1interface/voice-core for other recorded verdicts.
- Review the evidence and your use of @1interface/voice-core@0.5.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.