registry / @datalackey/typescript-build-config / 0.0.23

@datalackey/typescript-build-config@0.0.23

Shared build configuration for TypeScript projects — ESLint, and future tsconfig/Prettier presets

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 5.25 KB of source

Source & flagged code

3 flagged

package.jsonView file

Lines 2-42json

2 "name": "@datalackey/typescript-build-config",

3 "version": "0.0.23",

4 "description": "Shared build configuration for TypeScript projects — ESLint, and future tsconfig/Prettier presets",

5 "_comments": {

6 "exports": "This block lists the config files that will be extended by files in in src/toplevel - which are copied to consuming project root folder. An example: eslint.config.js imports from '@datalackey/typescript-build-config/eslint'.",

7 "files": "These are the files included in the package tarball. Dotfiles like .gitignore are excluded by npm by default and must be listed explicitly alongside src/."

8 },

9 "type": "module",

10 "main": "src/eslint.js",

11 "exports": {

12 "./eslint": "./src/eslint.js",

13 "./prettier": "./src/prettier.js",

14 "./tsconfig": "./src/tsconfig.base.json"

15 },

16 "files": [

17 "src/",

18 "src/top-level/.gitignore"

19 ],

20 "scripts": {

21 "prepack": "echo no build step required",

22 "postinstall": "node src/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 },

24 "publishConfig": {

25 "access": "public"

26 },

27 "engines": {

28 "node": ">=22"

29 },

30 "devDependencies": {

31 "@changesets/cli": "^2.29.8"

32 },

33 "dependencies": {

34 "@typescript-eslint/eslint-plugin": "^8.0.0",

35 "@typescript-eslint/parser": "^8.0.0",

36 "eslint": "^9.0.0",

37 "prettier": "^3.0.0"

38 },

39 "keywords": [

40 "eslint",

41 "typescript",

42 "config",

src/pipeline/auto-changeset.shView file

•path = src/pipeline/auto-changeset.sh kind = build_helper sizeBytes = 2361 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/pipeline/auto-changeset.shView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/pipeline/auto-changeset.shView file

•path = src/pipeline/auto-changeset.sh kind = build_helper sizeBytes = 2361 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/pipeline/auto-changeset.shView on unpkg

Findings

1 High4 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Build Helpersrc/pipeline/auto-changeset.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Source & flagged code

3 flagged

package.jsonView file

Lines 2-42json

2 "name": "@datalackey/typescript-build-config",

3 "version": "0.0.23",

4 "description": "Shared build configuration for TypeScript projects — ESLint, and future tsconfig/Prettier presets",

5 "_comments": {

7 "files": "These are the files included in the package tarball. Dotfiles like .gitignore are excluded by npm by default and must be listed explicitly alongside src/."

8 },

9 "type": "module",

10 "main": "src/eslint.js",

11 "exports": {

12 "./eslint": "./src/eslint.js",

13 "./prettier": "./src/prettier.js",

14 "./tsconfig": "./src/tsconfig.base.json"

15 },

16 "files": [

17 "src/",

18 "src/top-level/.gitignore"

19 ],

20 "scripts": {

21 "prepack": "echo no build step required",

22 "postinstall": "node src/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 },

24 "publishConfig": {

25 "access": "public"

26 },

27 "engines": {

28 "node": ">=22"

29 },

30 "devDependencies": {

31 "@changesets/cli": "^2.29.8"

32 },

33 "dependencies": {

34 "@typescript-eslint/eslint-plugin": "^8.0.0",

35 "@typescript-eslint/parser": "^8.0.0",

36 "eslint": "^9.0.0",

37 "prettier": "^3.0.0"

38 },

39 "keywords": [

40 "eslint",

41 "typescript",

42 "config",

src/pipeline/auto-changeset.shView file

•path = src/pipeline/auto-changeset.sh kind = build_helper sizeBytes = 2361 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/pipeline/auto-changeset.shView on unpkg