registry / Destructive action / @a11ign/screenreader-worker / 0.5.0

@a11ign/screenreader-worker@0.5.0

Drives a real NVDA screen reader through real navigation on Windows and returns what it announced. The HTTP contract is the API.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The Windows helper performs consequential system changes and is started automatically when the CLI server runs. This supports a warning for dangerous destructive capability, but the inspected source does not establish a concrete malicious attack chain.

Static reason

One or more suspicious static signals were detected.

Trigger

Run the CLI server on Windows without the skip variable or an existing trim marker.

Impact

Windows applications and protections may be removed or disabled.

Mechanism

The server starts a detached helper; the helper attempts elevation, removes selected provisioned apps, disables listed services, and tries to turn off real-time Defender monitoring.

AI rationale

Evidence

dist/server.mjsdist/windows-trim.mjspackage.json

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The published CLI entrypoint is `dist/server.mjs`.
On Windows, server startup launches a detached trim helper unless `A11Y_SKIP_TRIM=1` or a marker is present.
The helper can register and start a highest-privilege scheduled task to run the trim.
The trim removes selected provisioned Windows apps and attempts to disable real-time Defender monitoring.

Evidence against

The manifest has no install lifecycle scripts; the behavior is activated when the CLI server runs.
The trim is Windows-only and has an environment-variable opt-out.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinified

Manifest

CopyleftLicense

scanned 15 file(s), 319 KB of source

Source & flagged code

6 flagged

dist/windows-trim.mjsView file

1import { execFileSync } from "node:child_process"; L2: import { readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/windows-trim.mjsView on unpkg · L1

143function runTrimViaElevatedTask({ scriptPath, markerPath, taskName = "a11ytrim" }) { const user = "$([Security.Principal.WindowsIdentity]::GetCurrent().Name)"; const register = `$a = New-ScheduledTaskAction -Execute '${pro

Medium

Ai Review Evidence

The helper can register and start a highest-privilege scheduled task to run the trim.

dist/windows-trim.mjsView on unpkg · L143

228function tryDisableDefender() { if ("win32" !== process.platform) return { disabled: false, reason: "not windows" }; try { powershell("Set-MpPreference -DisableRealtimeMonitoring $true

Medium

Ai Review Evidence

The trim removes selected provisioned Windows apps and attempts to disable real-time Defender monitoring.

dist/windows-trim.mjsView on unpkg · L228

dist/server.mjsView file

1Cross-file remote execution chain: dist/server.mjs spawns dist/src_capture-core_mjs.mjs; helper contains network access plus dynamic code execution. L1: import { createServer } from "node:http"; L2: import { appendFileSync, existsSync, openSync, readFileSync, readdirSync, renameSync, statSync, statfsSync, writeFileSync } from "node:fs"; L3: import { execFile, execFileSync, spawn } from "node:child_process"; L4: import { promisify } from "node:util"; ... L7: import { join, resolve as external_node_path_resolve } from "node:path"; L8: import { inflateRawSync } from "node:zlib"; L9: import { rm } from "node:fs/promises"; ... L22: function powershellValue(script) { L23: if ("win32" !== process.platform) return "unknown"; L24: try { ... L47: try { L48: const { stdout } = await execFileAsync("po

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/server.mjsView on unpkg · L1

1414function trimWindowsAtBoot() { if ("win32" !== process.platform || "1" === process.env.A11Y_SKIP_TRIM) return; if (trimAlreadyDone(TRIM_MARKER)) return; try { const

Medium

Ai Review Evidence

On Windows, server startup launches a detached trim helper unless `A11Y_SKIP_TRIM=1` or a marker is present.

dist/server.mjsView on unpkg · L1414

package.jsonView file

46"bin": { "a11ign-nvda-worker": "./dist/server.mjs" }, "files": [ "dist", "

Medium

Ai Review Evidence

The published CLI entrypoint is `dist/server.mjs`.

package.jsonView on unpkg · L46

Source & flagged code

6 flagged · loading source

dist/windows-trim.mjsView file

1import { execFileSync } from "node:child_process"; L2: import { readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/windows-trim.mjsView on unpkg · L1

Medium

Ai Review Evidence

The helper can register and start a highest-privilege scheduled task to run the trim.

dist/windows-trim.mjsView on unpkg · L143

228function tryDisableDefender() { if ("win32" !== process.platform) return { disabled: false, reason: "not windows" }; try { powershell("Set-MpPreference -DisableRealtimeMonitoring $true

Medium

Ai Review Evidence

The trim removes selected provisioned Windows apps and attempts to disable real-time Defender monitoring.

dist/windows-trim.mjsView on unpkg · L228

Findings

2 High6 Medium4 Low

HighChild Processdist/windows-trim.mjs

HighCross File Remote Execution Contextdist/server.mjs

MediumNetwork

MediumEnvironment Vars

MediumAi Review Evidencepackage.json

MediumAi Review Evidencedist/server.mjs

MediumAi Review Evidencedist/windows-trim.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowCopyleft License

Affected versions and remediation

This report applies to @a11ign/screenreader-worker@0.5.0.

See all versions of @a11ign/screenreader-worker for other recorded verdicts.

Review the evidence and your use of @a11ign/screenreader-worker@0.5.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 17:04:30.024Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code