@doikayt/typescript-build-config@0.1.14

One or more suspicious static signals were detected.

npm install of the package

Supply-chain persistence and unauthorized release/publish capability in consumer repositories.

postinstall copies CI/release workflows and a release helper into the consumer project

On installation, postinstall writes release automation into a consuming project without an explicit user command or prompt. On future pushes to main, the injected workflow can modify repository contents, push tags, and publish packages using the consumer repository's NPM secret.

The package performs unconsented install-time mutation of a foreign repository's privileged CI and release surface. This creates a concrete supply-chain persistence and publishing path despite avoiding direct secret reads.