se-dev-script
Audited by Socket on Feb 26, 2026
1 alert found:
AnomalyThe script's purpose is environment setup for a Steam/Space Engineers mod project. It is not obviously a stealthy backdoor or explicitly malicious in its immediate logic, but it performs high-risk actions: executes a remote PowerShell install script (irm | iex) and downloads an executable without integrity checks; it also creates junctions into user data. These behaviors present a real supply-chain risk because a compromised remote host (astral.sh or frippery.org) or man-in-the-middle could execute arbitrary code on the developer's machine. Recommendation: do not run this script without auditing the remote install.ps1, replacing remote fetches with pinned, verified artifacts (checksums/signatures), and ensuring any downloaded executables are from trusted sources. Consider removing or sandboxing use of 'irm | iex' and verifying URLs and cryptographic integrity before execution.