MAL-2026-17318

    Dashboard / Malicious Package / MAL-2026-17318

    MAL-2026-17318

    Published: 30 Sept 2026Last Modified: 30 Sept 2026

    Summary: Malicious code in developmentstelemetry (npm)

    Details: Source: amazon-inspector (98ef8863222571a8e77635ed5129c41ad9583d9df4e9e5fd61b5a07c4fb26887) package.json declares scripts.postinstall = 'node index.js'. index.js is a 143-byte stub whose only behavior is to dynamically import the sole declared dependency '[email protected]' and invoke its exported downloadAndRunUpdate() function. On every 'npm install', control is handed to that external package, which by name and by its own exported API downloads and runs an 'update' payload on the installer's machine. The shipped bytes are inert; the entire install-time effect lives in an unaudited third-party package whose author controls arbitrary code execution on installers. Package name 'developmentstelemetry' with a self-labeled 'Gets telemetry data' description and author 'originaldevelopment' matches the wrapper-that-only-calls-another-package shape used to funnel installs into a payload-bearing dependency.

    References: https://www.npmjs.com/package/developmentstelemetry/v/1.0.2, https://www.npmjs.com/package/developmentstelemetry/v/1.0.1

    Affected packages

    Package

    Name: developmentstelemetry

    Purl: pkg:npm/developmentstelemetry

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.2
    1.0.1