telemetry-metrics

{"schema_version":"1.7.4","id":"MAL-2026-10750","published":"2026-07-16T18:45:17Z","modified":"2026-08-19T01:36:49.877704703Z","summary":"Malicious code in telemetry-metrics (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3ca5a92b8a793861df4d3480ffa064564909421659b72e6a9bb1f6af72847f55)\nThe package publishes as unscoped 'telemetry-metrics' while its README, repository, homepage, and bugs metadata all reference the legitimate @telemetry-js/telemetry project, and the bulk of the source is copied from that upstream. An added lib/plugin-options.js fetches https://raw.githubusercontent.com/ThoSuperstarDev/axios-http/main/lib/env/axios.exe (a mutable branch on an unrelated personal GitHub account), writes it to C:\\Windows\\http-axios.exe via fs.writeFileSync, and executes it via child_process.execFile. The pluginOptions function is invoked from lib/task.js on every plugin registration path (collect/process/publish/schedule/use), so ordinary library usage on Windows triggers the drop-and-run against the installer's host. The fetched binary is unpinned (mutable branch), unhashed, sourced from a publisher unrelated to the impersonated project, and staged into a system directory.\n","affected":[{"package":{"name":"telemetry-metrics","ecosystem":"npm"},"versions":["0.2.1","0.2.5","0.2.3","0.2.4","0.2.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/plugin-options.js","sha256":"6892a090d2758a7ebad33754ef48a38ee90d6a645817871fc21d93741b3b20d0","tlsh":"1df00e4b097a232693a534c082977c5fb110c1087a49c791822c0cc86d4011ce473980"},{"path":"package.json","sha256":"f906c109a5dd32e2296fc48422173adb2b20f2448f8df2c9b1ee7a013260af67","tlsh":"4e01a224ea215c630ed96aa39e6a1203b311dd275554fc0d778b431e972d4af21fe22d"}],"package_integrity":[{"filename":"telemetry-metrics-0.2.1.tgz","hashes":{"sha1":"d2a185a47fafee14e9e56c3c80378f1b9de0ba79","sha512_sri":"sha512-M5mACIQpqlx+XCCcCO9U/Uwcnn4UHhmDETj6JsjTA1KzL+UqMgJN/RmStUMoURocRFtSVpSq2XQ0bIr2Z7IzPA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/telemetry-metrics/v/0.2.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/telemetry-metrics/v/0.2.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/telemetry-metrics/v/0.2.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/telemetry-metrics/v/0.2.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/telemetry-metrics/v/0.2.2"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010771","import_time":"2026-07-16T18:54:03.844980117Z","modified_time":"2026-07-16T18:45:17Z","sha256":"2cd215db682d2cc6eb6c9d4f5f704b66503762047ac210160f07559c07e93dea","source":"amazon-inspector","versions":["0.2.1"]},{"id":"IN-MAL-2026-010903","import_time":"2026-07-28T14:19:58.336978604Z","modified_time":"2026-07-28T13:34:01Z","sha256":"1bb843a52a3b9144f4ab2f1233e2f48671524217cf93b7e16a85c9f5551dedb7","source":"amazon-inspector","versions":["0.2.5"]},{"id":"IN-MAL-2026-014941","import_time":"2026-08-05T14:19:45.072055063Z","modified_time":"2026-08-05T13:14:50Z","sha256":"3ca5a92b8a793861df4d3480ffa064564909421659b72e6a9bb1f6af72847f55","source":"amazon-inspector","versions":["0.2.3"]},{"id":"IN-MAL-2026-015796","import_time":"2026-08-05T16:13:46.025565394Z","modified_time":"2026-08-05T15:41:37Z","sha256":"98464f7aa81782713f6ddc5c715a283eca2df8df51fa99d92b0b8f57dc1ba2d4","source":"amazon-inspector","versions":["0.2.4"]},{"id":"IN-MAL-2026-018271","import_time":"2026-08-19T01:34:41.169043443Z","modified_time":"2026-08-19T01:16:31Z","sha256":"be4febbe54278c23fb18c8e97653087f66402b132f45929f2a8c1ebc65693f26","source":"amazon-inspector","versions":["0.2.2"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}