registry / @datalackey/typescript-build-config / 0.1.8

@datalackey/typescript-build-config@0.1.8

Shared build configuration for TypeScript projects — ESLint, and future tsconfig/Prettier presets

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 6.01 KB of source

Source & flagged code

4 flagged

package.jsonView file

Lines 2-42json

2 "name": "@datalackey/typescript-build-config",

3 "version": "0.1.8",

4 "description": "Shared build configuration for TypeScript projects — ESLint, and future tsconfig/Prettier presets",

5 "_comments": {

6 "exports": "This block lists the config files that will be extended by files in in src/toplevel - which are copied to consuming project root folder. An example: eslint.config.js imports from '@datalackey/typescript-build-config/eslint'.",

7 "files": "These are the files included in the package tarball. Dotfiles like .gitignore are excluded by npm by default and must be listed explicitly alongside src/."

8 },

9 "type": "module",

10 "main": "src/eslint.js",

11 "exports": {

12 "./eslint": "./src/eslint.js",

13 "./prettier": "./src/prettier.js",

14 "./tsconfig": "./src/tsconfig.base.json"

15 },

16 "files": [

17 "src/",

18 "src/top-level/.gitignore"

19 ],

20 "scripts": {

21 "prepack": "echo no build step required",

22 "postinstall": "node src/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 "update-all-format": "prettier --write src/ && update-markdown-toc README.md",

24 "check-format": "prettier --check src/ && update-markdown-toc --check README.md",

25 "ci": "npm run check-format && node --test",

26 "test": "node --test"

27 },

28 "publishConfig": {

29 "access": "public"

30 },

31 "engines": {

32 "node": ">=22"

33 },

34 "devDependencies": {

35 "@changesets/cli": "^2.29.8",

36 "@datalackey/update-markdown-toc": "^1.4.14"

37 },

38 "dependencies": {

39 "@typescript-eslint/eslint-plugin": "^8.0.0",

40 "@typescript-eslint/parser": "^8.0.0",

41 "eslint": "^9.0.0",

42 "prettier": "^3.0.0"

src/pipeline/auto-changeset.shView file

•path = src/pipeline/auto-changeset.sh kind = build_helper sizeBytes = 2940 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/pipeline/auto-changeset.shView on unpkg

src/postinstall.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @datalackey/typescript-build-config@0.1.6 matchedIdentity = npm:[redacted]:0.1.6 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/postinstall.jsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/pipeline/auto-changeset.shView file

•path = src/pipeline/auto-changeset.sh kind = build_helper sizeBytes = 2940 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/pipeline/auto-changeset.shView on unpkg

src/postinstall.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/postinstall.jsView on unpkg

Findings

2 High4 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltasrc/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Build Helpersrc/pipeline/auto-changeset.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Source & flagged code

4 flagged

package.jsonView file

Lines 2-42json

2 "name": "@datalackey/typescript-build-config",

3 "version": "0.1.8",

4 "description": "Shared build configuration for TypeScript projects — ESLint, and future tsconfig/Prettier presets",

5 "_comments": {

7 "files": "These are the files included in the package tarball. Dotfiles like .gitignore are excluded by npm by default and must be listed explicitly alongside src/."

8 },

9 "type": "module",

10 "main": "src/eslint.js",

11 "exports": {

12 "./eslint": "./src/eslint.js",

13 "./prettier": "./src/prettier.js",

14 "./tsconfig": "./src/tsconfig.base.json"

15 },

16 "files": [

17 "src/",

18 "src/top-level/.gitignore"

19 ],

20 "scripts": {

21 "prepack": "echo no build step required",

22 "postinstall": "node src/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 "update-all-format": "prettier --write src/ && update-markdown-toc README.md",

24 "check-format": "prettier --check src/ && update-markdown-toc --check README.md",

25 "ci": "npm run check-format && node --test",

26 "test": "node --test"

27 },

28 "publishConfig": {

29 "access": "public"

30 },

31 "engines": {

32 "node": ">=22"

33 },

34 "devDependencies": {

35 "@changesets/cli": "^2.29.8",

36 "@datalackey/update-markdown-toc": "^1.4.14"

37 },

38 "dependencies": {

39 "@typescript-eslint/eslint-plugin": "^8.0.0",

40 "@typescript-eslint/parser": "^8.0.0",

41 "eslint": "^9.0.0",

42 "prettier": "^3.0.0"

src/pipeline/auto-changeset.shView file

•path = src/pipeline/auto-changeset.sh kind = build_helper sizeBytes = 2940 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/pipeline/auto-changeset.shView on unpkg

src/postinstall.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/postinstall.jsView on unpkg