developmentstelemetry@1.0.1

Analysis

The postinstall hook runs a JavaScript stub that imports a bundled dependency and calls its downloader. The downloader fetches a remote HTML Application payload (updater.hta) from hxxps://raw[.]githubusercontent[.]com/$Acevatex/Testprogram/main/updater[.]hta, writes it to the system temp directory, and executes it with mshta in a detached, hidden process. This downloads and runs arbitrary remote code on the installer's machine at install time.