registry / @1interface/voice-shell / 0.5.1

@1interface/voice-shell@0.5.1

AI Security Review

scanned 3d ago · by lpm-firewall-ai

Installation automatically removes two dependency directories. The package source otherwise contains only small React provider wrappers, with no confirmed exfiltration or remote execution.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the package runs its postinstall lifecycle hook.

Impact

Can disrupt or alter the installed dependency layout.

Mechanism

Recursive deletion of local React dependency directories.

Rationale

The postinstall deletion is an unnecessary automatic mutation that can break an installation, so it warrants a warning. Static inspection found no concrete evidence of exfiltration, payload loading, persistence, or broader malicious behavior.

Evidence

package.jsonnode_modules/reactnode_modules/react-dom

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The automatic postinstall hook recursively deletes React and React DOM directories under node_modules.

Evidence against

The distributed JavaScript only exports React voice context providers.

@1interface/voice-shell@0.5.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code