LWA-2026-4451 confirmed malware
opentelemetry-plugin-graphql-example@55.33.111
Malicious code in opentelemetry-plugin-graphql-example (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1082 · System Information DiscoveryT1074.001 · Local Data Staging
Analysis
Package name opentelemetry-plugin-graphql-example combosquats OpenTelemetry. File does.js runs automatically on package installation: it creates a concealed directory, collects host identity data (hostname, OS platform, CPU architecture), and writes that data to a local file. No actual OpenTelemetry functionality, no README, only 3 trivial files — a reconnaissance/staging payload delivered through an npm installation trigger.
- analyzed by
- Leitwacht
- first seen
- Jun 11, 2026, 09:29 PM
- analyzed
- Jun 11, 2026, 09:33 PM
Related advisories
- opentelemetry-contrib-scripts@55.33.111
- mongodb-example@55.33.111
- vps-adapter-core@1.0.0
- web3-core-utils@4.3.5
- rollup-packages-polyfill-core@0.5.0
- opentracing-shim@55.33.111
- openclaw-preview@2026.6.1
- worker-build@9.0.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.