@atlassecurity/auth@1.0.3

One or more suspicious static signals were detected.

npm install, npm ci, or npm update

A remote release publisher can change code executed by consumers after installation while retaining a locally configured API key.

postinstall remote payload download and atomic source replacement

The package-manager postinstall hook queries a remote GitHub release. When its version is newer, it downloads remote assets and overwrites the installed entrypoint and package manifest. The downloaded code is not signed or hash-verified by the hook, and the hook preserves an existing API key while replacing the source. This creates an unconsented install-time remote code-update channel outside normal npm package integrity and review.

This is a concrete install-hook supply-chain mechanism, not a normal transparent setup step. It remotely replaces executable package code and package metadata during installation.