@realtek/core-theme@0.0.128

One or more suspicious static signals were detected.

npm postinstall when MONGO_DB_NAME/DB_NAME is set or an interactive user supplies a database name

Unconsented remote database modification and privileged account/permission creation.

Lifecycle-driven .env loading and MongoDB administrative seeding

The published postinstall invokes a MongoDB initializer. Before its skip checks it reads the consumer project's .env; if a database name is present, it selects an environment URI or embedded remote default, connects, creates/updates collections and indexes, seeds an administrator and broad permissions, then writes an installation marker. This is unconsented install-time mutation outside a theme library's normal scope.

Source inspection confirms concrete postinstall database mutation, not merely static network indicators. The limited noninteractive guard does not prevent execution when project environment variables provide a database name.