MAL-2026-14176 Malicious code in dev-env-check (npm)

On install, lib/platform-compat.js runs from the postinstall hook and, on Windows, uses powershell.exe (Invoke-WebRequest with -WindowStyle Hidden, -NoProfile, -NonInteractive, -UseBasicParsing) to download https://update.setuponline.click/update to %TEMP%\msedge_update.exe and then executes it detached via execFile with windowsHide. The C2 URL, the dropped filename, the powershell.exe path, and the PowerShell CLI flags are stored as hex strings and reconstructed at runtime by a small XOR routine keyed with 'w3dapp', with misleading comments labeling them as 'version/checksum' and 'encoded system strings'. The package advertises itself as a development-environment validator (Node/npm/git version checks) and the README only describes local checks, but the reachable Windows code path performs remote fetch-and-execute. The filename msedge_update.exe impersonates a Microsoft Edge update; update.setuponline.click is not a Microsoft domain.