I accidentally ran Import-Module Entra in PowerShell when I meant to use Microsoft.Entra. I removed it shortly afterward, but investigated the package because it was available in the public PowerShell module gallery.
The package description says it contains no functional code, and its main behavior appears to be printing a message that it is not the module users were looking for. However, the included script also collects telemetry, including a hard-coded API key. I didn't find anything obviously malicious, but the telemetry seems questionable and I'm wondering how others would assess the risk.
Could this simply be tracking how many people install the similarly named package by mistake, or should its presence be treated as a more serious supply-chain warning? I have already reported it and contacted the developer for clarification.
4 Answers
This kind of naming collision is one reason official modules are increasingly being distributed through more controlled registries. A public gallery allows nearly anyone to publish a package, so users have to distinguish trusted publishers from lookalike names themselves.
Public package galleries contain plenty of stale, poorly maintained, or suspicious-looking scripts. They can be useful, but availability there should not be treated as proof that a package is trustworthy. For enterprise systems, verify the publisher, inspect the source, pin versions, and use an internal approval process before installing anything.
The hard-coded API key in the telemetry script is definitely questionable, even if the current package does not appear malicious. A key embedded in a public script should be assumed to be exposed, and collecting information from installers should be clearly disclosed and justified.
The package does not appear to perform anything overtly harmful. Its main function is just displaying a warning that it is not the module you intended to install. The telemetry looks more like an installation counter than an attack, possibly to measure how often the typo occurs.
That matches what I found too. I still think collecting telemetry without making it especially clear is a strange choice, since a malicious package with the same naming strategy could have done much worse.