@materialui-reactjs/admin@1.0.5

One or more suspicious static signals were detected.

npm install

Unconsented dependency injection and alteration of the consumer project.

postinstall child-process mutation of consumer manifest

The postinstall hook identifies the consumer project through INIT_CWD or node_modules ancestry, creates its package.json if absent, then launches a detached Node child. After a delay, the child adds every missing peer dependency to the consumer manifest and writes it back. This is an unconsented install-time mutation of a foreign project, with delayed and detached execution that makes the change less visible.

The package performs concrete, unconsented postinstall mutation of the consuming project's dependency manifest through a detached delayed process. No exfiltration was found, but the install hook itself is harmful and unjustified for a component library.