umbraco-reference-instance

The code appears to be an administrative provisioning utility rather than malware. It contains no evident obfuscation, reverse shell, unrelated data exfiltration, or dynamic code execution. However, it has significant security risks: hardcoded default administrator and client secrets, creation of a highly privileged API user, transmission over a potentially unencrypted configurable URL, and trust in an arbitrary target URL. It should not be used in production without secure secret injection, HTTPS enforcement, least-privilege group assignment, credential rotation, and strict target validation.