{"id":"MAL-2026-10750","summary":"Malicious code in telemetry-metrics (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2cd215db682d2cc6eb6c9d4f5f704b66503762047ac210160f07559c07e93dea)\ntelemetry-metrics@0.2.1 impersonates @telemetry-js/telemetry — its package.json repository/homepage/bugs and README badges all reference the legitimate telemetry-js/telemetry project, but the code diverges. The exported plugin() method (reachable via the package's public API, e.g. require('telemetry-metrics')().plugin()) fetches https://raw.githubusercontent.com/ThoSuperstarDev/axios-http/main/lib/env/te.txt and writes the response bytes to C:\\Windows\\1.txt via fs.writeFileSync. The source is a mutable branch on a personal GitHub account unrelated to the impersonated publisher, so the delivered bytes are attacker-controlled and can change over time. The destination is a Windows system directory, consistent with staging content for later execution / DLL-search-order abuse / privileged path abuse. The upstream @telemetry-js/telemetry package has no equivalent remote-fetch behavior.\n","modified":"2026-07-16T19:20:00.169503282Z","published":"2026-07-16T18:45:17Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010771","import_time":"2026-07-16T18:54:03.844980117Z","modified_time":"2026-07-16T18:45:17Z","sha256":"2cd215db682d2cc6eb6c9d4f5f704b66503762047ac210160f07559c07e93dea","source":"amazon-inspector","versions":["0.2.1"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/telemetry-metrics/v/0.2.1"}],"affected":[{"package":{"name":"telemetry-metrics","ecosystem":"npm","purl":"pkg:npm/telemetry-metrics"},"versions":["0.2.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/telemetry-metrics/MAL-2026-10750.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"tlsh":"1df00e4b097a232693a534c082977c5fb110c1087a49c791822c0cc86d4011ce473980","path":"lib/plugin-options.js","sha256":"6892a090d2758a7ebad33754ef48a38ee90d6a645817871fc21d93741b3b20d0"},{"sha256":"f906c109a5dd32e2296fc48422173adb2b20f2448f8df2c9b1ee7a013260af67","tlsh":"4e01a224ea215c630ed96aa39e6a1203b311dd275554fc0d778b431e972d4af21fe22d","path":"package.json"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-M5mACIQpqlx+XCCcCO9U/Uwcnn4UHhmDETj6JsjTA1KzL+UqMgJN/RmStUMoURocRFtSVpSq2XQ0bIr2Z7IzPA==","sha1":"d2a185a47fafee14e9e56c3c80378f1b9de0ba79"},"filename":"telemetry-metrics-0.2.1.tgz"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}