hugo-bin@0.165.0

One or more suspicious static signals were detected.

npm installation triggers the postinstall hook.

Installation can destroy consumer vendor content and execute a binary obtained from an operator-configurable source.

The hook derives the consumer root from INIT_CWD, recursively deletes vendor there, and invokes the configured binary downloader.

On installation, the package executes an installer that resolves the consuming project's root and recursively deletes its vendor directory. This deletion is inconsistent with the package's binary destination, which is under the package itself. The installer then downloads and runs a Hugo binary; its repository prefix can be supplied through environment or project configuration. Together, the automatic destructive mutation and configurable binary source create a concrete install-time supply-chain attack surface.

The postinstall hook deletes consumer-project data without a package-aligned need, then executes a downloaded binary. This is concrete destructive install-time behavior, not ordinary wrapper setup.