registry / @doikayt/typescript-build-config / 0.1.13

@doikayt/typescript-build-config@0.1.13

Shared build configuration for TypeScript projects — ESLint, Prettier, tsconfig, and Playwright presets

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Install-time project scaffolding is present, but no confirmed malicious behavior is established. The copied GitHub workflows publish only to registry.npmjs.org using the consumer's configured secret.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install or update; Playwright helper import for local browser discovery.

Impact

May seed absent project configuration and CI/release files; no exfiltration, remote payload, destructive action, or AI-agent control-surface write found.

Mechanism

Copies declared build/release templates and assets; locally probes Chromium with which.

Rationale

The install hook is an invasive but documented build-config scaffold and preserves pre-existing divergent files. Source inspection found no concrete malicious chain, network exfiltration, secret harvesting, remote execution, or agent-control mutation.

Evidence

package.jsonsrc/postinstall.jssrc/pipeline/release.ymlsrc/pipeline/verify-npm-token.ymlsrc/playwright.jssrc/top-level/gitignoretsconfig.jsontsconfig.test.jsontsconfig.eslint.jsoneslint.config.jsprettier.config.js.github/workflows/release.yml.github/workflows/verify-npm-token.yml.changeset/config.jsonscripts/auto-changeset.sh

@doikayt/typescript-build-config@0.1.13

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code