@1interface/voice-shell@0.5.2

One or more suspicious static signals were detected.

npm installation runs the postinstall lifecycle hook.

The consumer application can be broken or left with missing dependencies; failures are hidden.

Recursive deletion of consumer dependencies via shell command.

During installation, npm invokes the package's postinstall command. That command recursively deletes node_modules/react and node_modules/react-dom in the consuming project, then suppresses errors. The published runtime bundle is only a React-based voice provider, so this destructive lifecycle behavior is unrelated to its stated code function.

The package contains a concrete, automatic, and destructive install hook that mutates the consumer project without consent. No exfiltration was found, but the install-time deletion alone warrants blocking publication.