randompkga@1.0.13

One or more suspicious static signals were detected.

npm installation of randompkga

Unexpected dependency injection into the installer project.

postinstall mutation of INIT_CWD/package.json

On installation, package.json invokes postinstall.js. The script resolves INIT_CWD/package.json, reads it, adds randompkgb to dependencies, and writes the consuming project's manifest back. This is an unconsented install-time modification of a foreign project that causes a separate package to be introduced on a later dependency installation.

The package contains a concrete postinstall dependency-injection chain against the installer project's package.json. No benign package function or user-invoked setup path justifies this mutation.