Malicious code in developmentstelemetry (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (98ef8863222571a8e77635ed5129c41ad9583d9df4e9e5fd61b5a07c4fb26887) package.json declares scripts.postinstall = 'node index.js'. index.js is a 143-byte stub whose only behavior is to dynamically import the sole declared dependency '[email protected]' and invoke its exported downloadAndRunUpdate() function. On every 'npm install', control is handed to that external package, which by name and by its own exported API downloads and runs an 'update' payload on the installer's machine. The shipped bytes are inert; the entire install-time effect lives in an unaudited third-party package whose author controls arbitrary code execution on installers. Package name 'developmentstelemetry' with a self-labeled 'Gets telemetry data' description and author 'originaldevelopment' matches the wrapper-that-only-calls-another-package shape used to funnel installs into a payload-bearing dependency.
Malicious code in developmentstelemetry (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (98ef8863222571a8e77635ed5129c41ad9583d9df4e9e5fd61b5a07c4fb26887) package.json declares scripts.postinstall = 'node index.js'. index.js is a 143-byte stub whose only behavior is to dynamically import the sole declared dependency '[email protected]' and invoke its exported downloadAndRunUpdate() function. On every 'npm install', control is handed to that external package, which by name and by its own exported API downloads and runs an 'update' payload on the installer's machine. The shipped bytes are inert; the entire install-time effect lives in an unaudited third-party package whose author controls arbitrary code execution on installers. Package name 'developmentstelemetry' with a self-labeled 'Gets telemetry data' description and author 'originaldevelopment' matches the wrapper-that-only-calls-another-package shape used to funnel installs into a payload-bearing dependency.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-17318
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6abcdde50df196e1a9da730f
Added to database: 09/30/2026, 10:01:09 UTC
Last updated: 09/30/2026, 14:19:01 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.