registry / @1interface/voice-core / 0.5.7
@1interface/voice-core@0.5.7
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe postinstall command is narrowly scoped to relative package-local paths, while React is declared as a peer dependency. The inspected network behavior is consistent with voice functionality and does not establish an attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Installation triggers the postinstall cleanup; importing and using the voice module can trigger an ICE server request.
Impact
No concrete harmful effect was established from the inspected source.
Mechanism
The install command removes relative React directories. The runtime request fetches ICE configuration from a shared API endpoint using access-token headers.
AI rationale
The postinstall command is narrowly scoped to relative package-local paths, while React is declared as a peer dependency. The inspected network behavior is consistent with voice functionality and does not establish an attack.
Evidence
package.jsondist/index.mjs
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares React and React DOM as peer dependencies, consistent with a React voice library.
- The module fetches ICE server data from the shared API endpoint and attaches access-token headers, consistent with voice functionality.
Evidence against
- The postinstall script removes only relative node_modules/react and node_modules/react-dom paths; the inspected command does not target the consumer project root.
Behavioral surface
Network
HighEntropyStringsMinifiedTrivialUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg32"peerDependencies": {
"@reduxjs/toolkit": "^2.0.0",
"react": "^18.0.0 || ^19.0.0",
"react-dom": "^18.0.0 || ^19.0.0",
"react-redux": "^9.0.0"
},
"devDependencie
Low
Suspicious Dependency Evidence
package.json declares React and React DOM as peer dependencies, consistent with a React voice library.
package.jsonView on unpkg · L3259"postinstall": "rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true"
}
}
Findings
1 High2 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Dependency Evidencepackage.json
LowAi Review Evidencedist/index.mjs
LowSuspicious Dependency Evidencepackage.json
Affected versions and remediation
This report applies to @1interface/voice-core@0.5.7.
See all versions of @1interface/voice-core for other recorded verdicts.
- Review the evidence and your use of @1interface/voice-core@0.5.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.