registry / Destructive action / @a11ign/screenreader-worker / 0.3.0

@a11ign/screenreader-worker@0.3.0

Drives a real NVDA screen reader through real navigation on Windows and returns what it announced. The HTTP contract is the API.

AI Security Review

scanned 17d ago · by lpm-firewall-ai

The source shows consequential host modifications activated by worker startup, including attempts to disable security protection. Transparent provisioning structure and the absence of installation hooks support a dangerous-capability warning rather than a malicious verdict.

Static reason

One or more suspicious static signals were detected.

Trigger

Run a11ign-nvda-worker on Windows without A11Y_SKIP_TRIM=1 and without a completed trimming marker.

Impact

Successful operations reduce host protection and update availability and remove installed Windows components.

Mechanism

The server spawns the local trimming helper, which invokes PowerShell to remove selected apps, disable services, and attempt to disable Defender real-time monitoring.

AI rationale

Evidence

dist/server.mjsdist/windows-trim.mjs.windows-trimmed.windows-trimmed.log.windows-trimmed.json

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest exposes a worker command and contains no automatic installation hooks or runtime self-dependency.
Starting the worker on Windows automatically launches system trimming unless explicitly skipped or already completed.
The trimming helper attempts to disable Defender real-time protection.
The helper disables selected services, including Windows Update, and removes selected provisioned apps.

Evidence against

The behavior is implemented transparently as Windows worker provisioning, with platform and completion guards.
No covert credential export or remote payload execution was established in the inspected source.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinified

Manifest

CopyleftLicense

scanned 15 file(s), 317 KB of source

Source & flagged code

6 flagged

dist/windows-trim.mjsView file

1import { execFileSync } from "node:child_process"; L2: import { readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/windows-trim.mjsView on unpkg · L1

234powershell("Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction Stop"); } catch (erro

Medium

Ai Review Evidence

The trimming helper attempts to disable Defender real-time protection.

dist/windows-trim.mjsView on unpkg · L234

211powershell(`sc.exe config ${name} start= disabled`); result.disabled.push(name); } catch (error) {

Medium

Ai Review Evidence

The helper disables selected services, including Windows Update, and removes selected provisioned apps.

dist/windows-trim.mjsView on unpkg · L211

dist/server.mjsView file

1Cross-file remote execution chain: dist/server.mjs spawns dist/src_capture-core_mjs.mjs; helper contains network access plus dynamic code execution. L1: import { createServer } from "node:http"; L2: import { appendFileSync, existsSync, openSync, readFileSync, readdirSync, renameSync, statSync, statfsSync, writeFileSync } from "node:fs"; L3: import { execFile, execFileSync, spawn } from "node:child_process"; L4: import { promisify } from "node:util"; ... L7: import { join, resolve as external_node_path_resolve } from "node:path"; L8: import { inflateRawSync } from "node:zlib"; L9: import { rm } from "node:fs/promises"; ... L22: function powershellValue(script) { L23: if ("win32" !== process.platform) return "unknown"; L24: try { ... L47: try { L48: const { stdout } = await execFileAsync("po

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/server.mjsView on unpkg · L1

1414function trimWindowsAtBoot() { if ("win32" !== process.platform || "1" === process.env.A11Y_SKIP_TRIM) return; if (trimAlreadyDone(TRIM_MARKER)) return; try { const script = fileUR

Medium

Ai Review Evidence

Starting the worker on Windows automatically launches system trimming unless explicitly skipped or already completed.

dist/server.mjsView on unpkg · L1414

package.jsonView file

46"bin": { "a11ign-nvda-worker": "./dist/server.mjs" }, "files": [ "dist", "

Medium

Suspicious Dependency Evidence

The manifest exposes a worker command and contains no automatic installation hooks or runtime self-dependency.

package.jsonView on unpkg · L46

Source & flagged code

6 flagged · loading source

dist/windows-trim.mjsView file

1import { execFileSync } from "node:child_process"; L2: import { readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/windows-trim.mjsView on unpkg · L1

234powershell("Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction Stop"); } catch (erro

Medium

Ai Review Evidence

The trimming helper attempts to disable Defender real-time protection.

dist/windows-trim.mjsView on unpkg · L234

211powershell(`sc.exe config ${name} start= disabled`); result.disabled.push(name); } catch (error) {

Medium

Ai Review Evidence

The helper disables selected services, including Windows Update, and removes selected provisioned apps.

dist/windows-trim.mjsView on unpkg · L211

dist/server.mjs

Findings

2 High6 Medium4 Low

HighChild Processdist/windows-trim.mjs

HighCross File Remote Execution Contextdist/server.mjs

MediumNetwork

MediumEnvironment Vars

MediumSuspicious Dependency Evidencepackage.json

MediumAi Review Evidencedist/server.mjs

MediumAi Review Evidencedist/windows-trim.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowCopyleft License

Affected versions and remediation

This report applies to @a11ign/screenreader-worker@0.3.0.

See all versions of @a11ign/screenreader-worker for other recorded verdicts.

Review the evidence and your use of @a11ign/screenreader-worker@0.3.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-06 11:05:36.286Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code