Malicious code in dev-env-check (npm)
The npm package 'dev-env-check' version 1.0.3 contains malicious code that executes during installation on Windows systems. It uses a postinstall hook to run a PowerShell command that downloads and executes a file named msedge_update.exe from a suspicious external URL, impersonating a Microsoft Edge update. The malicious behavior is obfuscated using XOR encoding with misleading comments. The package falsely advertises itself as a development environment validator but performs unauthorized remote code execution.
AI Analysis
Technical Summary
The 'dev-env-check' npm package version 1.0.3 includes a postinstall script that, on Windows, runs a PowerShell command to silently download an executable from 'https://update.setuponline.click/update' to the temporary directory as 'msedge_update.exe' and executes it detached. The URL, filename, PowerShell path, and command-line flags are stored as hex strings and decoded at runtime via an XOR routine keyed with 'w3dapp', with deceptive comments to hide their true purpose. This behavior enables remote fetch-and-execute of potentially malicious code under the guise of a development environment validation tool.
Potential Impact
This malicious package can lead to arbitrary code execution on Windows systems during installation, potentially allowing attackers to run unauthorized software under the context of the user installing the package. The downloaded executable masquerades as a legitimate Microsoft Edge update, increasing the likelihood of successful deception and execution of malicious payloads.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing version 1.0.3 of 'dev-env-check'. Verify the integrity and source of npm packages before installation, especially those that run postinstall scripts. Consider removing the package if already installed and scanning affected systems for the downloaded executable. Monitor vendor advisories for any updates or official fixes.
Malicious code in dev-env-check (npm)
Description
The npm package 'dev-env-check' version 1.0.3 contains malicious code that executes during installation on Windows systems. It uses a postinstall hook to run a PowerShell command that downloads and executes a file named msedge_update.exe from a suspicious external URL, impersonating a Microsoft Edge update. The malicious behavior is obfuscated using XOR encoding with misleading comments. The package falsely advertises itself as a development environment validator but performs unauthorized remote code execution.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'dev-env-check' npm package version 1.0.3 includes a postinstall script that, on Windows, runs a PowerShell command to silently download an executable from 'https://update.setuponline.click/update' to the temporary directory as 'msedge_update.exe' and executes it detached. The URL, filename, PowerShell path, and command-line flags are stored as hex strings and decoded at runtime via an XOR routine keyed with 'w3dapp', with deceptive comments to hide their true purpose. This behavior enables remote fetch-and-execute of potentially malicious code under the guise of a development environment validation tool.
Potential Impact
This malicious package can lead to arbitrary code execution on Windows systems during installation, potentially allowing attackers to run unauthorized software under the context of the user installing the package. The downloaded executable masquerades as a legitimate Microsoft Edge update, increasing the likelihood of successful deception and execution of malicious payloads.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing version 1.0.3 of 'dev-env-check'. Verify the integrity and source of npm packages before installation, especially those that run postinstall scripts. Consider removing the package if already installed and scanning affected systems for the downloaded executable. Monitor vendor advisories for any updates or official fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14176
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4caacd9273b49252e6c
Added to database: 08/19/2026, 13:51:06 UTC
Last enriched: 08/19/2026, 14:50:47 UTC
Last updated: 08/19/2026, 14:50:47 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.