@doikayt/typescript-build-config@0.1.16

One or more suspicious static signals were detected.

npm install or npm ci of the package

Unconsented project and CI control-plane modification; later workflow execution can use the consumer's NPM secret and repository write permission.

postinstall copies absent project files and GitHub Actions workflows

The package has a real, broad install-hook capability that mutates consumer CI/release configuration, including a token-backed publishing workflow. It is transparent and package-aligned rather than concrete malware, so warning is appropriate.