Affected script: "install-scripts:preinstall"

The script installs a Visual Basic Script (VBS) file to the user's Startup folder, which executes a batch file silently at every system startup. The batch file runs a PowerShell script that continuously monitors the clipboard for content and posts any text found on the clipboard to a specified URL via HTTP POST. This behavior can be used to capture and exfiltrate sensitive information, such as passwords, credit card numbers, or personal data, to a remote server without the user's knowledge. The use of -ExecutionPolicy Bypass in the batch file allows the PowerShell script to run even if the execution policy would normally prevent it, which bypasses security measures intended to block the execution of potentially harmful scripts. Additionally, installing scripts to the Startup folder ensures persistence after reboots, further compromising the system's security.