@a11ign/screenreader-worker@0.5.1
Drives a real NVDA screen reader through real navigation on Windows and returns what it announced. The HTTP contract is the API.
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe worker’s normal startup triggers broad system changes, including an attempt to disable Defender, and may obtain elevated execution through a scheduled task. This is concrete destructive behavior and warrants blocking.
Static reason
One or more suspicious static signals were detected.
Trigger
Launching the worker on Windows, unless A11Y_SKIP_TRIM is set or the trim marker already exists.
Impact
System apps and services may be removed or disabled, and real-time malware protection may be turned off.
Mechanism
The worker starts a detached helper that runs PowerShell commands to remove apps, disable services, and change Defender settings; it can schedule the helper at highest privilege when needed.
Attack narrative
When the command-line worker starts on Windows, it launches a detached trim helper unless skipped or previously marked complete. The helper removes provisioned apps, disables services, and attempts to disable Defender real-time protection. If the worker is not elevated, it can register a highest-privilege scheduled task to run the helper.
AI rationale
The worker’s normal startup triggers broad system changes, including an attempt to disable Defender, and may obtain elevated execution through a scheduled task. This is concrete destructive behavior and warrants blocking.
Evidence
dist/server.mjsdist/windows-trim.mjs.windows-trimmed
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The command-line worker runs the Windows trim routine automatically when it starts.
- The trim routine removes provisioned apps and disables Windows services.
- The routine attempts to disable Defender real-time monitoring.
- When not elevated, it can register and start a highest-privilege scheduled task to run the trim.
Evidence against
- The package has no install lifecycle hook; the behavior activates when the worker is launched.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsMinified
CopyleftLicense
Source & flagged code
6 flagged · loading sourcedist/windows-trim.mjsView file
1import { execFileSync } from "node:child_process";
L2: import { readFileSync, writeFileSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/windows-trim.mjsView on unpkg · L1202for (const pkg of packagesToRemove(installedProvisionedPackages()))try {
powershell(`Remove-AppxProvisionedPackage -Online -PackageName '${pkg}' -ErrorAction Stop`);
result.removed.push(pkg);
} catch (error) {
result.failed.push(pkg.split("_")[0]);
log(`trim: could not remove ${pkg}: ${error.message.split("\n")[0]}`);
}
for (const
High
Ai Review Evidence
The trim routine removes provisioned apps and disables Windows services.
dist/windows-trim.mjsView on unpkg · L202209for (const { name } of DISABLEABLE_SERVICES){
try {
powershell(`sc.exe config ${name} start= disabled`);
result.disabled.push(name);
} catch (error) {
result.failed.push(name);
log(`trim: coul
High
Ai Review Evidence
The trim routine removes provisioned apps and disables Windows services.
Findings
6 High2 Medium4 Low
HighChild Processdist/windows-trim.mjs
HighCross File Remote Execution Contextdist/server.mjs
HighAi Review Evidencedist/server.mjs
HighAi Review Evidencedist/server.mjs
HighAi Review Evidencedist/windows-trim.mjs
HighAi Review Evidencedist/windows-trim.mjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowCopyleft License
Affected versions and remediation
This report applies to @a11ign/screenreader-worker@0.5.1.
See all versions of @a11ign/screenreader-worker for other recorded verdicts.
- Avoid installing @a11ign/screenreader-worker@0.5.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.