dev-proxy-init

SUSPICIOUS rather than benign due to unverified publisher/install provenance for the core dev-proxy package and the ability to make privileged local system changes, but the overall behavior mostly matches the stated purpose of local reverse-proxy setup. No clear credential harvesting or exfiltration is present; the main risk is install trust plus local configuration impact.