web-artifacts-builder

SUSPICIOUS: the stated purpose is coherent for a frontend artifact builder, but the real install/execution path is opaque because the key shell scripts are missing. The main risk is supply-chain exposure from unseen local scripts and third-party npm build plugins, not confirmed malicious behavior or credential theft.

This appears to be a legitimate scaffolding/setup script with no direct indicators of intentional malware (no exfiltration, backdoor logic, or obfuscated execution). However, its supply-chain integrity is meaningfully weakened by (1) blind extraction of a local tarball into `src/` without checksum/signature verification (allowing arbitrary code injection into the app), and (2) broad dependency installation from public registries with limited version pinning (increasing exposure to compromised or unexpected upstream packages/install-script execution). The main concern is supply-chain tampering rather than overt malicious behavior in the script.