hatcher-utility-dev@1.0.0

Analysis

The package's postinstall hook (scripts/postinstall.js) runs on every install and serializes the installer's entire process environment (including any NPM_TOKEN, GITHUB_TOKEN, AWS credentials, and other secrets present at install time) into KEY=VALUE lines, writing them to ./env.hat in the package install directory with mode 0600. The README claims the hook is gated to Linux hosts with an existing /home/hatch directory, but the code performs no such check: it writes the environment dump unconditionally. The harvested file is not the file the package's own CLI reads, so the write serves no functional purpose other than collecting the installer's environment into a file.