registry / @doikayt/typescript-build-config / 0.1.42
@doikayt/typescript-build-config@0.1.42
⚠ Under reviewShared build configuration for TypeScript projects — ESLint, Prettier, tsconfig, and Playwright presets
AI Security Review
scanned 9d ago · by lpm-firewall-aiInspected source shows an install hook for project setup and a Playwright helper, with no confirmed attack behavior. The bundled PDF’s binary contents remain unresolved, so the review cannot establish that it is harmless.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
The manifest activates the postinstall hook when the package is installed; no inspected source shows that hook loading the PDF.
Impact
No concrete harmful effect was identified; the unresolved PDF prevents a clean verdict.
Mechanism
The inspected hook copies named configuration, pipeline, and logo files. The PDF is absent from its asset list, but its binary contents were not verified.
AI rationale
Inspected source shows an install hook for project setup and a Playwright helper, with no confirmed attack behavior. The bundled PDF’s binary contents remain unresolved, so the review cannot establish that it is harmless.
Evidence
assets/image/jews-support-a-free-palestine-poster.pdfpackage.jsonsrc/postinstall.js
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest runs src/postinstall.js during installation.
- The inspected install hook copies only named configuration, pipeline, and logo files; the PDF is not in its asset list.
- The Playwright config helper locates a system Chromium executable, and its install command runs only when invoked directly.
Evidence against
- No concrete attack behavior was established in the inspected executable source.
- The PDF’s contents and role could not be resolved from the available artifact information.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node src/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node src/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg28"postinstall": "node src/postinstall.js",
"update-all-format": "prettier --write src/ && update-markdown-toc README.md && upda
Low
Suspicious Lifecycle Evidence
The manifest runs src/postinstall.js during installation.
package.jsonView on unpkg · L28src/pipeline/auto-changeset.shView file
Findings
3 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy Blobassets/image/jews-support-a-free-palestine-poster.pdf
HighKnown Malware Source Similaritysrc/playwright.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Build Helpersrc/pipeline/auto-changeset.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencesrc/postinstall.js
Affected versions and remediation
This report applies to @doikayt/typescript-build-config@0.1.42.
See all versions of @doikayt/typescript-build-config for other recorded verdicts.
- Review the evidence and your use of @doikayt/typescript-build-config@0.1.42 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.