@fastify-core/single@1.0.6

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

npm postinstall

Unconsented dependency injection into the consuming project, affecting later installs and supply-chain resolution.

detached child-process mutation of consumer package.json

The manifest invokes a postinstall hook. That hook resolves the consumer project root, creates its package.json if absent, and launches a detached, stdio-suppressed Node process. After a delay, the child adds every peer dependency declared by this package to the consumer's dependencies and rewrites the manifest. This occurs without a user command or confirmation and can continue after npm considers the installation complete.

This is concrete unconsented install-time mutation of a foreign project manifest, concealed in a detached delayed child process. No exfiltration was found, but the dependency-injection behavior independently warrants blocking.