registry / my-wispr-npm / 0.3.0

my-wispr-npm@0.3.0

Offline speech-to-text for Node.js — pipe any PCM stream into whisper.cpp. Same core for WebSocket SaaS, desktop apps, and VS Code extensions.

AI Security Review

scanned 13h ago · by lpm-firewall-ai

No malicious install-time behavior is confirmed. An explicit setup command has a shell-injection flaw through `WISPR_MODEL_NAME`.

Static reason

No blocking static signals were detected.

Trigger

User runs `my-wispr-setup` or `npm run setup` with attacker-controlled `WISPR_MODEL_NAME`.

Impact

Arbitrary local command execution with the setup user's privileges.

Mechanism

Unquoted environment-variable interpolation into `execSync` shell command.

Rationale

Direct inspection found no malicious lifecycle chain, but it did confirm a user-invoked shell-injection vulnerability in setup.

Evidence

package.jsonscripts/postinstall.jsscripts/setup.jssrc/index.jssrc/server.jsREADME.md

Network endpoints1

github.com/ggerganov/whisper.cpp.git

public snapshot

AI called this Suspicious at 90.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

`scripts/setup.js` interpolates `WISPR_MODEL_NAME` into `execSync` without shell quoting.