@pisell/pisellos@2.2.169

Analysis

Critical maintainer_change finding: publisher email changed from [account] (corporate domain) to [account] (personal QQ email). This is a classic account takeover indicator - corporate to personal email transition with lifecycle hooks present (prepublishOnly). Package is a booking/solution library (~7.7MB) with no obvious token-theft markers in investigation, but the maintainer change pattern itself is high-risk and cannot be dismissed without verifying the legitimacy of the email change. Requires human review to confirm whether this is an authorized maintainer transition or a compromised account.