Thank you for sharing this!

I was in the early stages of rewriting their shady .js installer to something else as well. A .js file spawning shell objects raised some alarms in our security software..

Have you heard of the PS App Deployment Toolkit? It has custom PowerShell functions to create shortcuts. The file association part just launches an executable - most likely it just stays opened when you run it as SYSTEM (from SCCM). The toolkit has an Execute-Process function which is easy to use with many parameters and it also has a -NoWait switch. I'm thinking you could execute that process, add a few second sleep timer and the kill the process. Not pretty but I've had to use that with some temperamental installers.

You've done the hard part already, I'll try wrapping it in a PSADT package and see if there's a way to work around that glitch.