registry / @aayushdebugging/claude-voice / 0.1.2

@aayushdebugging/claude-voice@0.1.2

Real-time voice conversations for the Claude CLI — talk to Claude naturally from your terminal.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 70 file(s), 231 KB of source, external domains: 127.0.0.1, api.elevenlabs.io, api.groq.com, api.openai.com, api.sarvam.ai, claude.com, elevenlabs.io, github.com, huggingface.co, registry.npmjs.org, sourceforge.net

Source & flagged code

1 flagged

dist/audio/recorder.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { AudioError } from '../utils/errors.js';

3import { averageAmplitude, peakAmplitude } from '../utils/wav.js';

4import { logger } from '../utils/logger.js';

5/**

6 * Peak amplitude below which a mic is treated as producing no real signal

7 * (i.e. no OS permission). A working mic — even in a silent room — easily

8 * exceeds this from ambient/electrical noise; digital silence sits near 0.

9 */

10const MIC_LIVE_FLOOR = 60;

11const cmdAvailable = new Map();

12/** True if a command resolves on PATH (cached per command name). */

13async function hasCommand(cmd) {

14 const cached = cmdAvailable.get(cmd);

15 if (cached !== undefined)

16 return cached;

17 const ok = await new Promise((resolve) => {

18 try {

19 const finder = process.platform === 'win32' ? 'where' : 'which';

20 const child = spawn(finder, [cmd]);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/audio/recorder.jsView on unpkg · L1

21 child.on('error', () => resolve(false));

Source & flagged code

1 flagged · loading source

dist/audio/recorder.jsView file

1import { spawn } from 'node:child_process'; L2: import { AudioError } from '../utils/errors.js'; ... L18: try { L19: const finder = process.platform === 'win32' ? 'where' : 'which'; L20: const child = spawn(finder, [cmd]); ... L37: } L38: return 'Install SoX from https://sourceforge.net/projects/sox/ and add it to your PATH.'; L39: } ... L54: function defaultProgram() { L55: if (process.env.CLAUDE_VOICE_RECORDER) L56: return process.env.CLAUDE_VOICE_RECORDER;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/audio/recorder.jsView on unpkg · L1

Findings

1 High3 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/audio/recorder.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/audio/recorder.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { AudioError } from '../utils/errors.js';

3import { averageAmplitude, peakAmplitude } from '../utils/wav.js';

4import { logger } from '../utils/logger.js';

5/**

6 * Peak amplitude below which a mic is treated as producing no real signal

7 * (i.e. no OS permission). A working mic — even in a silent room — easily

8 * exceeds this from ambient/electrical noise; digital silence sits near 0.

9 */

10const MIC_LIVE_FLOOR = 60;

11const cmdAvailable = new Map();

12/** True if a command resolves on PATH (cached per command name). */

13async function hasCommand(cmd) {

14 const cached = cmdAvailable.get(cmd);

15 if (cached !== undefined)

16 return cached;

17 const ok = await new Promise((resolve) => {

18 try {

19 const finder = process.platform === 'win32' ? 'where' : 'which';

20 const child = spawn(finder, [cmd]);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/audio/recorder.jsView on unpkg · L1

21 child.on('error', () => resolve(false));