@fastify-core/single@1.0.4

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

npm install runs the postinstall lifecycle hook.

Unexpected dependency changes can alter the consumer supply chain and persist beyond installation.

detached postinstall project-manifest dependency injection

On installation, the lifecycle hook resolves the consumer project from INIT_CWD, creates its package.json if missing, and spawns a detached, silent Node process. After a delay, that child inserts every peer dependency from this package into the consumer manifest. This is an unconsented install-time modification of a foreign project and is deliberately decoupled from npm’s lifecycle process.

The package contains concrete, stealthy postinstall mutation of the consuming project’s dependency manifest. No network exfiltration is needed for this install-hook supply-chain abuse to be malicious.