@1interface/voice-shell@0.5.8
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe postinstall command performs a real, potentially disruptive deletion, but its scope is limited to paths relative to the package directory and no broader attack behavior was found. This warrants a warning rather than a publication block.
Static reason
One or more suspicious static signals were detected.
Trigger
The package's postinstall lifecycle hook runs during installation.
Impact
Locally installed peer copies may be deleted, potentially breaking package use; no broader attack was established.
Mechanism
It runs a recursive removal command against node_modules/react and node_modules/react-dom relative to the package directory.
AI rationale
The postinstall command performs a real, potentially disruptive deletion, but its scope is limited to paths relative to the package directory and no broader attack behavior was found. This warrants a warning rather than a publication block.
Evidence
package.jsonnode_modules/reactnode_modules/react-dom
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The postinstall hook recursively removes React and React DOM directories relative to the package directory.
- The package declares React and React DOM as peer dependencies, so the cleanup could remove locally installed peer copies.
Evidence against
- The removal targets only two package-local paths; no broader consumer-tree mutation, network activity, or payload execution was found in the inspected files.
Behavioral surface
Trivial
NoLicense
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg59"postinstall": "rm -rf node_modules/react node_modules/react-dom 2>/dev/null || true"
}
}
Medium
Suspicious Lifecycle Evidence
The postinstall hook recursively removes React and React DOM directories relative to the package directory.
package.jsonView on unpkg · L5932"peerDependencies": {
"@reduxjs/toolkit": "^2.0.0",
"react": "^18.0.0 || ^19.0.0",
"react-dom": "^18.0.0 || ^19.0.0",
"react-redux": "^9.0.0"
},
"devDependencie
Findings
1 High3 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Dependency Evidencepackage.json
LowScripts Present
LowNo License
Affected versions and remediation
This report applies to @1interface/voice-shell@0.5.8.
See all versions of @1interface/voice-shell for other recorded verdicts.
- Review the evidence and your use of @1interface/voice-shell@0.5.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.