I accidentally ran Import-Module Entra in PowerShell when I meant to use Microsoft.Entra. I realized the mistake quickly, removed the module, and then inspected it because it was published in the PowerShell Gallery. The package description says it contains no functional code, but the included script does collect telemetry. I didn't find anything obviously malicious, although the script contains a hard-coded API key and the telemetry seems questionable. The module appears to mainly display a message saying it is not the module you were looking for. Could this simply be tracking how often people install the typosquat, or is there anything more concerning that I should look for? I have already reported it and contacted the developer for an explanation.
4 Answers
This is also why official modules are increasingly being distributed through more controlled registries. A public gallery lets anyone publish a package with a convincing name, so typosquatting is possible even when the package is ultimately harmless.
There are plenty of low-quality or suspicious packages in public PowerShell repositories. Many are harmless, but the lack of strong trust controls means you should treat packages like downloaded code: inspect them, verify the publisher, and prefer official sources or known maintainers for anything used in an enterprise environment.
From what the script does, the package mainly prints a warning that it is not the real module. The telemetry is probably being used to measure how many people fall for the name, possibly so the author can write about the results. That explains the behavior, though it does not make the collection especially appropriate.
The telemetry does not appear inherently malicious, but a hard-coded API key and undisclosed data collection are definitely questionable. It looks more like the author is counting accidental installs than trying to compromise systems, but you were right to report it and investigate instead of assuming it was safe.
That was my impression too. I contacted the developer and reported it, since it still feels like an unnecessary risk even if the intent was just tracking installs.
That matches what I found. I mainly wanted a second opinion in case I had overlooked something more dangerous.