@pisell/pisellos@2.2.168

Analysis

Critical maintainer_change finding: email changed from [account] to [account]. Package has prepublishOnly lifecycle hook (runs npm run build - benign). Investigation found no token-theft markers. The eval() usage in lib/plugins/window.js is legitimate - it's a mock browser setTimeout/setInterval implementation for a sandboxed environment SDK. Package appears to be a frontend modular SDK framework. However, repository URL uses generic 'username' placeholder (github[.]com/username/pisell-os), and I cannot independently verify the publisher identity transition. Given Critical severity and inability to fully confirm this is a legitimate corporate email migration vs. account takeover, recommending human review.