@doikayt/typescript-build-config@0.1.45
⚠ Under reviewShared build configuration for TypeScript projects — ESLint, Prettier, tsconfig, and Playwright presets
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe inspected entrypoints show configuration and Playwright setup, and the install hook lists only the two logo assets for copying. However, the shipped poster has no supported structural or executable analysis, so its behavior cannot be resolved from this snapshot.
Decision evidence
public snapshot- The manifest runs a postinstall hook and includes the assets/image directory in the package.
- The hook’s asset-seeding list names only two logo files; it does not list the flagged poster.
- Offline analysis could not identify the poster’s format or inspect its behavior, leaving a material uncertainty.
- The Playwright entrypoint configures Chromium paths for Playwright; the inspected code does not establish malicious behavior.
- The postinstall asset list names only the package’s PNG and SVG logos.
- The Playwright code uses an environment-provided or discovered Chromium executable path as launch configuration.
Source & flagged code
7 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe manifest runs a postinstall hook and includes the assets/image directory in the package.
package.jsonView on unpkg · L21Findings
Affected versions and remediation
This report applies to @doikayt/typescript-build-config@0.1.45.
See all versions of @doikayt/typescript-build-config for other recorded verdicts.
- Review the evidence and your use of @doikayt/typescript-build-config@0.1.45 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.