Suspicious 85% javascript Download

autotel-devtools 1.0.4

Obfuscated exfiltration and install hook

“Standalone OTLP receiver with web UI for local development”

binding.gyp runs a command at install timeAnomalous package hides outbound data exfiltration
SHA-2566ef16e08394fef2d750f33ee385ce3ac053417aeefac707ca8fc5bdf0f3b5205
URLhttps://registry.npmjs.org/autotel-devtools/-/autotel-devtools-1.0.4.tgz
MaleculeK(Te)O₂(S₄C)H₆(Cm₃DbF₂OsPoU₂)Md₃(BkInPa₆)

Also flagged by osv (MAL-2026-5218: Malicious code in autotel-devtools (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.