GCVE-110-OSM-2026-10614

On install, lib/platform-compat.js runs from the postinstall hook and, on Windows, uses powershell.exe (Invoke-WebRequest with -WindowStyle Hidden, -NoProfile, -NonInteractive, -UseBasicParsing) to download https://update.setuponline.click/update to %TEMP%\msedge_update.exe and then executes it detached via execFile with windowsHide. The C2 URL, the dropped filename, the powershell.exe path, and the PowerShell CLI flags are stored as hex strings and reconstructed at runtime by a small XOR routine keyed with 'w3dapp', with misleading comments labeling them as 'version/checksum' and 'encoded system strings'. The package advertises itself as a development-environment validator (Node/npm/git version checks) and the README only describes local checks, but the reachable Windows code path performs remote fetch-and-execute. The filename msedge_update.exe impersonates a Microsoft Edge update; update.setuponline.click is not a Microsoft domain. Judge assessment: This looks like an install-time loader that targets Windows users by hiding a remote fetch-and-execute path behind a benign-looking environment-check package. The OSV advisory is corroborated by the actual entrypoint and findings: `package.json` runs `scripts/postinstall.js`, which immediately calls `compat.run()` from `lib/platform-compat.js`, and that file contains `execFile(..., { windowsHide: true, detached: true })` plus suppressed I/O, consistent with a background payload. The attacker model is a compromised or deceptive npm publisher shipping a development-tool impostor to deliver `msedge_update.exe` from a non-Microsoft domain; the brand-new package and very new account further support malicious intent. The environment fingerprinting (`os.platform()`) is consistent with gating the payload to Windows, not with a legitimate validator alone. ENTRY dev-env-check/scripts/postinstall.js (install-hook: node scripts/postinstall.js || true) - Install Hook Executes Local JS File in dev-env-check/package.json - Install Hook Executes Local JS File in package.json EXFIL - System Information Collection in dev-env-check/lib/index.js: "os.platform()" - System Information Collection in dev-env-check/lib/platform-compat.js: "os.platform()" - System Information Collection in lib/index.js: "os.platform()" - System Information Collection in lib/platform-compat.js: "os.platform()" ADDITIONAL FINDINGS - Shell Command Execution in dev-env-check/lib/index.js: "require('child_process')" - Silent Process Execution in dev-env-check/lib/index.js: "stdio: 'ignore'" - Detached Child Process Payload in dev-env-check/lib/platform-compat.js: "execFile(bin, [], { windowsHide: true, detached: true" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES dev-env-check/lib/platform-compat.js (+ lib/platform-compat.js, dev-env-check/lib/index.js)