your-ai-workflow-firebase-os@1.2.32

One or more suspicious static signals were detected.

npm installation

It can replace application files, modify dependency configuration, and control future AI-agent behavior in the project.

postinstall rewrites consumer files and AI instruction files

npm invokes scripts/postinstall.js on installation. The script locates the consumer root, clears CSS files, rewrites main.tsx and App.tsx, adds dependencies to package.json, modifies vite.config.ts, and creates configuration files. It also creates or refreshes root-level AGENTS.md and GEMINI.md, which are broad AI-agent control-surface files outside the package's own directory. These mutations occur without an explicit user command or confirmation.

The automatic postinstall hook mutates foreign consumer application files and root-level AI-agent instruction files. This meets the policy for malicious install-hook abuse despite no observed exfiltration or network activity.