@1interface/voice-shell@0.1.0

One or more suspicious static signals were detected.

npm install postinstall; runtime import of exported React providers

Possible local install layout mutation only; no confirmed data theft, remote execution, persistence, or agent hijack

local peer dependency cleanup and React context provider exports

Source inspection shows a small React wrapper package with a postinstall cleanup script limited to local nested React dependencies. No concrete malicious behavior, exfiltration, remote code execution, persistence, or AI-agent control-surface mutation was present.