registry / @doikayt/typescript-build-config / 0.1.12

@doikayt/typescript-build-config@0.1.12

Shared build configuration for TypeScript projects — ESLint, Prettier, tsconfig, and Playwright presets

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 8.38 KB of source

Source & flagged code

3 flagged

package.jsonView file

Lines 4-44json

4 "description": "Shared build configuration for TypeScript projects — ESLint, Prettier, tsconfig, and Playwright presets",

5 "_comments": {

6 "exports": "This block lists the config files that will be extended by files in in src/toplevel - which are copied to consuming project root folder. An example: eslint.config.js imports from '@doikayt/typescript-build-config/eslint'.",

7 "files": "These are the files included in the package tarball. Dotfiles like .gitignore are excluded by npm by default and must be listed explicitly alongside src/."

8 },

9 "type": "module",

10 "main": "src/eslint.js",

11 "exports": {

12 "./eslint": "./src/eslint.js",

13 "./prettier": "./src/prettier.js",

14 "./tsconfig": "./src/tsconfig.base.json",

15 "./playwright": "./src/playwright.js"

16 },

17 "files": [

18 "src/",

19 "src/top-level/.gitignore",

20 "assets/"

21 ],

22 "scripts": {

23 "prepack": "echo no build step required",

24 "postinstall": "node src/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "update-all-format": "prettier --write src/ && update-markdown-toc README.md",

26 "check-format": "prettier --check src/ && update-markdown-toc --check README.md",

27 "ci": "npm run check-format && node --test",

28 "test": "node --test"

29 },

30 "publishConfig": {

31 "access": "public"

32 },

33 "engines": {

34 "node": ">=22"

35 },

36 "devDependencies": {

37 "@changesets/cli": "^2.29.8",

38 "@doikayt/update-markdown-toc": "^1.4.17",

39 "@playwright/test": "^1.40.0"

40 },

41 "dependencies": {

42 "@typescript-eslint/eslint-plugin": "^8.0.0",

43 "@typescript-eslint/parser": "^8.0.0",

44 "eslint": "^9.0.0",

src/pipeline/auto-changeset.shView file

•path = src/pipeline/auto-changeset.sh kind = build_helper sizeBytes = 2940 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/pipeline/auto-changeset.shView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/postinstall.js

High

Install Time Lifecycle Scripts

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code