@1interface/shared-core@0.9.0

One or more suspicious static signals were detected.

npm installation runs the postinstall lifecycle hook.

Breaks the consumer application's React installation and can cause denial of service or force unexpected dependency resolution.

silent recursive deletion of consumer dependencies

When npm installs this package, its postinstall command recursively deletes the consumer's React and React DOM directories. Error output is redirected away and failure is ignored, making the destructive action less visible. This is unrelated to the shared-core library's normal runtime behavior and alters the consuming project's dependency tree without consent.

The manifest establishes a concrete automatic destructive action against foreign project dependencies. This is malicious install-hook abuse, not a package-aligned setup step.