MalwarePublished 16 Jul 2026Updated 19 Aug 2026

telemetry-metrics (npm) · Malicious Code

Affects telemetry-metricsSource GCVE Database

Malicious package : remove telemetry-metrics and rotate any secrets on hosts that installed it.

Data as of 19 Aug 2026, 16:44 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10750

What to do

Remove telemetry-metrics from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtelemetry-metrics	Affected =0.2.1 =0.2.5 =0.2.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The telemetry-metrics npm package versions 0.2.1, 0.2.3, and 0.2.5 contain malicious code that downloads and executes a binary from an untrusted, mutable GitHub branch. This binary is saved to a Windows system directory and executed automatically during normal library usage on Windows hosts. The package impersonates a legitimate telemetry project but includes unauthorized code that performs this harmful action.

Impact

Systems running affected telemetry-metrics package versions on Windows will automatically download and execute an untrusted binary in a system directory, potentially leading to arbitrary code execution and system compromise. The malicious binary source is uncontrolled and mutable, increasing the risk of further malicious payloads. This compromises the security and integrity of affected hosts.

Defensive guidance

Users should immediately stop using the affected telemetry-metrics package versions (=0.2.1, =0.2.3, =0.2.5). Remove any installations of this package from Windows systems and verify that no unauthorized binaries (such as C:\Windows\http-axios.exe) remain. Monitor for suspicious activity related to this package. Check the vendor or package repository for updates or official advisories before resuming use.

Summary

The telemetry-metrics npm package, published as an unscoped package while referencing the legitimate @telemetry-js/telemetry project, contains injected malicious code in versions 0.2.1, 0.2.3, and 0.2.5. The malicious code adds a plugin-options.js file that fetches a binary executable from a mutable branch on an unrelated personal GitHub repository. This binary is saved to C:\Windows\http-axios.exe and executed via child_process.execFile on every plugin registration path, causing automatic execution on Windows systems. The fetched binary is neither hashed nor pinned, increasing risk. This behavior effectively results in a drop-and-run malware infection vector embedded within a seemingly legitimate npm package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 19 Aug 2026, 16:44 UTC

Technical details

References

Community reviews