web-artifacts-builder

No direct evidence of malware or intentional data theft appears in the supplied fragment. It documents a build/setup tool with legitimate shell execution, but reports meaningful supply-chain risk from unpinned package installation and lifecycle-script execution, plus medium archive-extraction risk. Review and pin dependencies, verify lockfiles and registries, inspect the tarball contents, and validate archive paths before trusting the underlying package.

This appears to be a legitimate scaffolding/setup script with no direct indicators of intentional malware (no exfiltration, backdoor logic, or obfuscated execution). However, its supply-chain integrity is meaningfully weakened by (1) blind extraction of a local tarball into `src/` without checksum/signature verification (allowing arbitrary code injection into the app), and (2) broad dependency installation from public registries with limited version pinning (increasing exposure to compromised or unexpected upstream packages/install-script execution). The main concern is supply-chain tampering rather than overt malicious behavior in the script.