@doikayt/typescript-build-config@0.1.19

One or more suspicious static signals were detected.

npm install, npm ci, or npm update executing postinstall

Adds a release pipeline with repository-write and npm-publish capability to projects that lack those files.

automatic consumer-project scaffolding and GitHub Actions workflow seeding

Source shows a disclosed but unusually invasive postinstall hook that seeds privileged CI release infrastructure. It is not concrete malware, but warrants a warning because installation mutates downstream repositories and can introduce publish-capable automation.