@fastify-core/single@1.0.2

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

npm install / postinstall

Unexpected dependency injection and persistent project-manifest modification.

detached postinstall rewrite of the consuming project's package.json

Installing the package executes scripts/postinstall.cjs. It locates INIT_CWD or a node_modules parent, creates that project's package.json if missing, then spawns a detached Node process that waits and inserts every peer dependency into the project's dependencies. This silently alters the consumer's dependency graph outside normal package-manager resolution and suppresses child-process output and errors.

The install hook performs concrete, unconsented mutation of a foreign project manifest and injects numerous dependencies in a detached process. No exfiltration was found, but this is sufficient malicious install-hook behavior.