yusufkhon-guard@1.2.0

One or more suspicious static signals were detected.

npm installation as a dependency, followed by starting the modified application.

The package takes control of consumer application startup behavior without an explicit setup command.

Postinstall source injection followed by Express module monkey-patching.

During npm installation, the postinstall hook finds a JavaScript entry file in the consuming project and prepends a require or import for this package. That import runs at application startup, replaces Express's cached export, and automatically installs the package middleware on every new Express app. This is an unconsented install-time mutation of a foreign application control surface.

The package deliberately rewrites consumer source during postinstall and causes runtime monkey-patching through the injected import. That concrete install-time behavior warrants blocking even though no exfiltration endpoint is present.