dev-env-check@1.0.3

Analysis

The postinstall hook of dev-env-check@1.0.3 runs a hidden Windows-only downloader. On win32 it invokes PowerShell (hidden, non-interactive) to download a remote binary from hxxps://updatesetup[.]online/click/update to %TEMP%\msedge_update.exe and then executes that downloaded file detached. The package's documented purpose is only benign development-environment checks (Node/npm/git version validation); the remote download-and-execute behaviour is concealed behind XOR-obfuscated strings and is not disclosed.