originaldevelopmentstelemetry @1.2.7
Vulnerability report · Last retrieved from osv.dev August 31, 2026 at 7:41 PM UTC
OSV ID
MAL-2026-15586
Ecosystem
npm
Summary
The package is advertised as a telemetry utility but its sole exported function, downloadAndRunClient , downloads updater.hta from raw.githubusercontent.com/Acevatex/Testprogram/main/updater.hta (an unrelated personal GitHub account, on the mutable main branch, with no pinning and no hash or signature check), writes it to a temporary path, and launches it via Windows mshta as a detached process. HTA execution grants the remote repository owner arbitrary code execution on any Windows host that invokes this function, and the fetched content can change at any time without a new package release. The stated 'telemetry' purpose is inconsistent with a Windows HTA runner, and the author metadata is a generic 'originaldevelopments' identity.
Source: amazon-inspector (60940a80ca72863b54a3cc8f1cc7da49be77b38e9111d4cb77cfc1417671f399)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.