@realtek/core-theme@0.0.300

High-risk behavior combination matched malicious policy.

npm postinstall when CORE_THEME_AUTO_DB_INIT=1 and a database name is supplied; also explicit bin invocation

Creates or updates an enabled ADMIN account and broad permissions in the selected database.

MongoDB connection and privileged admin/permission seeding

On an enabled install, the package loads the consumer project's .env, selects a supplied or embedded MongoDB URI, connects, creates or updates collections, and seeds an ADMIN user with enabled menu permissions. The operation is not documented in the README and includes a hard-coded private database endpoint, making the privileged remote mutation an unsafe and concrete package behavior.

The package contains a guarded but real postinstall path that performs privileged database administration against an embedded remote endpoint. This exceeds a UI theme library's expected behavior and can establish administrative access.