fca-nx@1.1.0

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Import or require of index.js

Unconsented dependency mutation and execution of remotely obtained package lifecycle code

Import-time silent npm installation of nx-fca

On import, index.js schedules checkForFCAUpdate silently. The updater queries npm for nx-fca, a different package name from fca-nx, then executes npm install nx-fca@<latest> --save in the consumer working directory. It may also rewrite the consumer package.json and exits the process. This unconsented import-time remote dependency installation permits execution of code from a separately controlled package.

The import-time updater silently installs a mismatched remote package into the caller's project. This is concrete unconsented remote code execution behavior, not a normal user-invoked update flow.