The npm package vite-plugin-cleaner version 4.1.3 includes an optional dependency on vite-cleaning-tools, which is fetched directly from a mutable GitHub repository reference without a fixed commit or tag. This causes the postinstall script to execute code from the latest GitHub HEAD on every npm install, allowing the repository maintainer or anyone with write access to inject arbitrary code at install time without publishing a new npm version.