registry / @1interface/voice-shell / 0.5.3

@1interface/voice-shell@0.5.3

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Installing the package automatically deletes the consumer's React and React DOM directories. This is destructive install-time mutation unrelated to the package's exported UI providers.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation runs the postinstall lifecycle hook.

Impact

Breaks or alters the consumer project's dependency tree while hiding deletion errors.

Mechanism

Recursive shell deletion of consumer dependencies.

Attack narrative

On installation, npm runs the package's postinstall command. It recursively removes React and React DOM from the consuming project's node_modules and redirects errors away. The shipped modules only provide React voice-context wrappers, so this destructive dependency mutation is not required for their operation.

AI rationale

The package contains a concrete, automatic, destructive postinstall action against consumer dependencies. Its normal source does not justify that mutation.

Evidence

package.jsonnode_modules/reactnode_modules/react-dom

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The automatic postinstall hook recursively deletes React and React DOM from the consumer project's node_modules.

@1interface/voice-shell@0.5.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code