The telemetry-metrics npm package versions 0.2.1, 0.2.3, and 0.2.5 contain malicious code that downloads and executes a binary from an untrusted, mutable GitHub branch. This binary is saved to a Windows system directory and executed automatically during normal library usage on Windows hosts. The package impersonates a legitimate telemetry project but includes unauthorized code that performs this harmful action.