prisma-callback@1.0.0

prisma-callback@1.0.3 is a name-confusion package against the genuine `prisma` ORM. Its `package.json` declares `"preinstall": "node./scripts/only-allow-pnpm.js pnpm"`; despite the misleading filename, that script dispatches on `os.arch()` and unconditionally executes one of two Go binaries shipped at the tarball root — `prisma-amd64` (sha256 7255674131eee4a4b9adb12196a1b66e3faad9ee60740ab01b4d4e91bf8a30a8, 1,597,624 bytes) or `prisma-arm64` (sha256 270769b70e1fe3718243e5f2f4655d9dd5d3b9f6e7217919d724859f7d6a66db, 2,162,872 bytes) — via `child_process.execSync` with inherited stdio, running under whatever privileges `npm install` holds. Neither binary exists in the genuine Prisma source tree; both are opaque compiled artifacts the installer cannot inspect or verify. To lower scrutiny, the tarball ships a verbatim copy of the real Prisma monorepo (README badges, issue templates, and every sub-package's `package.json` point at `github.com/prisma/prisma`), and the preinstall script carries a `// This script is safe — it's only used for testing purposes.` comment to discourage review. The structural signals — typosquat of a top-tier OSS package + undeclared opaque native binaries + preinstall-time execution without integrity verification + deliberate misdirection via filename, comment, and legitimate-looking cover source — are jointly unambiguous.