se-dev-server-code
Warn
Audited by Socket on May 9, 2026
1 alert found:
AnomalyAnomalyPrepare.bat
LOWAnomalyLOW
Prepare.bat
No direct indicators of classic malware (credential harvesting, exfiltration, reverse shell) are present in this batch file. The main security concern is supply-chain exposure: it executes a remotely fetched PowerShell installer via `iex`, downloads an executable (`busybox64u.exe`) without checksum verification, and installs a .NET global tool (`ilspycmd`) without provenance checks. It also uses junctions that amplify the impact if SE_SERVER_ROOT is mis-set. Treat as potentially risky from a supply-chain perspective and verify the external URLs, signatures/hashes, and the integrity of the invoked scripts (Decompile.sh and referenced Python files).
Confidence: 66%Severity: 58%
Audit Metadata