The telemetry-metrics npm package, published as an unscoped package while referencing the legitimate @telemetry-js/telemetry project, contains injected malicious code in versions 0.2.1, 0.2.3, and 0.2.5. The malicious code adds a plugin-options.js file that fetches a binary executable from a mutable branch on an unrelated personal GitHub repository. This binary is saved to C:\Windows\http-axios.exe and executed via child_process.execFile on every plugin registration path, causing automatic execution on Windows systems. The fetched binary is neither hashed nor pinned, increasing risk. This behavior effectively results in a drop-and-run malware infection vector embedded within a seemingly legitimate npm package.

Systems running affected telemetry-metrics package versions on Windows will automatically download and execute an untrusted binary in a system directory, potentially leading to arbitrary code execution and system compromise. The malicious binary source is uncontrolled and mutable, increasing the risk of further malicious payloads. This compromises the security and integrity of affected hosts.

No official patch or remediation is currently documented. Users should immediately stop using the affected telemetry-metrics package versions (=0.2.1, =0.2.3, =0.2.5). Remove any installations of this package from Windows systems and verify that no unauthorized binaries (such as C:\Windows\http-axios.exe) remain. Monitor for suspicious activity related to this package. Check the vendor or package repository for updates or official advisories before resuming use.