@fastify-core/single@1.0.1

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

npm install

Unconsented modification of the consumer project and its future dependency resolution.

detached postinstall manifest mutation and dependency injection

The package performs an unconsented install-time mutation outside its own directory, but the inspected source shows no payload retrieval, exfiltration, destructive action, or AI-agent control-surface targeting. This is a concrete install-hook abuse risk best surfaced as a warning.