@doikayt/typescript-build-config
Shared build configuration for TypeScript projects — ESLint, Prettier, tsconfig, and Playwright presets
This report shows the evidence for @doikayt/typescript-build-config@0.1.14. 1 of 32 known versions is blocked or flagged. The newest version, 0.1.55, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package performs unconsented install-time mutation of a foreign repository's privileged CI and release surface. This creates a concrete supply-chain persistence and publishing path despite avoiding direct secret reads.
Decision evidence
public snapshot- package.json runs postinstall automatically.
- src/postinstall.js writes .github/workflows/release.yml into the consumer project.
- src/pipeline/release.yml grants contents: write and id-token: write, then commits, pushes, and publishes.
- src/postinstall.js creates missing workflow directories and does not require user confirmation.
- src/pipeline/auto-changeset.sh generates release changesets from consumer git history.
- Existing destination files are not overwritten.
- No credential harvesting or direct exfiltration was found.
- The Playwright installer is an explicit bin, not import-time execution.
Source & flagged code
4 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage ships non-JavaScript build or shell helper files.
src/pipeline/auto-changeset.shView on unpkgFindings
Affected versions and remediation
This report applies to @doikayt/typescript-build-config@0.1.14.
The versions list below shows the verdict for each recorded version.
- Avoid installing @doikayt/typescript-build-config@0.1.14. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.