talking-stick@0.12.0

One or more suspicious static signals were detected.

npm postinstall under node_modules/talking-stick

Arbitrary code from the mutable release source can execute with the installing user's privileges.

remote binary bootstrap and execution during postinstall

Installing the package runs postinstall, which invokes a bootstrapper. When no usable skiller binary exists, it downloads a release archive and its checksum from the same GitHub release path, installs the extracted executable under the user's home directory, and runs it. This is unconsented install-time remote payload execution; the checksum does not provide an independently pinned trust boundary.

The package executes a remotely fetched binary during postinstall, with release selection and checksum material both controlled by the same external source. This establishes a concrete install-time remote-code-execution chain.