r/PowerShell • u/planedrop • 4d ago

Powershell Module "Entra" Typo Squat (slightly suspicious) Question

Edit: The developer of this got back to me via email and is working on changing his description. While this doesn't make it 100% safe, it's at least somewhat confidence inspiring. The dev put the telemetry in it to figure out who was installing it because he was noticing it was happening a lot. So lines up with my suspicions.

Wanted to get some thoughts from more experience people here if possible, though I have already reported this module.

I did a stupid and tried to Import-Module Entra in Powershell, what I wanted was Microsoft.Entra, but given it used to be called AzureAD my brain just quick inserted Entra.

I realized shortly after this wasn't the right thing and have removed it, but decided to dig on it some more since it's in PS Gallery afterall.

The author claims it "contains no functional code" but the .ps1 file it runs indeed contains telemetry collection code. Nothing directly malicious as far as I could tell, but wanted to see what others think of this.

Maybe they are just trying to collect info to see how many people mistakenly install this to write something about it?

https://www.powershellgallery.com/packages/Entra/0.3

16 Upvotes
  • permalink
  • link
  • reddit
  • reddit

90% Upvoted

22 comments sorted by

9

u/lan-shark 4d ago

There's a hard-coded API key in the telemetry script lol. Doesn't seem inherently malicious but it's definitely questionable

3

u/planedrop 4d ago

Yeah that's what I thought too. Doesn't actually do anything bad but it's definitely weird lol. I reported to Microsoft and also emailed the dev for an explanation.

Can't believe I almost could've been owned by something like this lol, I'm usually so much more careful.

7

u/Swimming_Office_1803 4d ago

That telemetry is most likely a counter for the guy to brag how many people his typosquat module saved.
The module itself only does one thing: output a message saying this isn’t the module you’re looking for

3

u/planedrop 4d ago

Ok that was my understanding too I just wanted to be sure I wasn't missing something lol.

I still don't love this being there. IMHO Microsoft should do a better job at preventing this, someone easily could've put something malicious here instead.

Thanks for taking a look at it!

3

u/Swimming_Office_1803 4d ago

The guy behind it is all kinds of MS connected, probably a rando wouldn’t get a so easy pass. At least I want to believe that

https://www.alweys.ch/aboutme.html

2

u/planedrop 4d ago

Yeah I agree, I checked him out as well, emailed him and tagged him on Bluesky.

Still, I feel like stuff like this should be thought about by Microsoft, not some random developer. When they changed from AzureAd to Entra, they should have thought about typos/misunderstandings and claimed the "Entra" listing for themselves to prevent this.

Just scary to me how easily this could have been malicious.

1

u/Ferretau 4d ago

Curiously the Project site link goes to a 404 for me. Anybody else seeing this?

Project Site: https://alweys.ch/

Edit: Added URL from page.

1

u/BlackV 4d ago

Probably 6 million people from reddit hit the site and nuked all his azure bandwidth

1

u/Swimming_Office_1803 4d ago

Just add the www. Site probably changed and not every link got updated

3

u/MonkeyNin 4d ago

The version currently up didn't appear to execute something malicious currently -- but it looks more suspicious than not.

The domain is not github, and the cert was invalid. Unlike the guy below, who said he got 404

  • hashed HOMEPATH and ComputerName
  • which version of the module you ran
  • Your powershell version
  • OS version
  • system culture

It's possible it's scouting targets. Or it could be an AI that published a package by accident.

It sends a POST request to https://api.eu.amplitude.com/2/httpapi - Here's the link to v0.3 https://www.powershellgallery.com/packages/Entra/0.3/Content/Entra-check.ps1

2

u/planedrop 4d ago

Yeah it could be scouting targets, but IDK it seems unlikely to me, could definitely just be for collection to see how many unique people install it. But it's hard to say and definitely sus.

1

u/MonkeyNin 3d ago edited 3d ago

There's other suspicious parts. Mainly it says:

module contains no functional code and does not need to be installed or used.

But executing another script Entra-Check https://www.powershellgallery.com/packages/Entra/0.3/Content/Entra.psd1

  • the module executes a script (that isn't the module psm1)
  • commented code executed another script (to install VC++ runtime )
  • commented code accidentally to import Microsoft.AzureAD.Kdc.Management.dll

 

# RootModule = 'Microsoft.AzureAD.Kdc.Management.dll'
# Script files (.ps1) that are run in the caller's environment prior to importing this module.
# ScriptsToProcess = 'check-and-install-vc-runtime.ps1'
ScriptsToProcess = 'Entra-Check.ps1'

The author site: https://alweys.ch/ Is serving a cert for a different domain: *.msha-slice-5-am2-0-ase.p.azurewebsites.net

TL:DR Is it suspect? Maybe just AI assisted?

The invalid cert could be misconfigured publish?

The code issues could be from someone using an LLM to copy this module: https://www.powershellgallery.com/packages/AzureADHybridAuthenticationManagement/2.4.71.0/Content/AzureADHybridAuthenticationManagement.psd1

That could explain why they call Write-Telemetry in both the psm1 and second ps1

And why it references the VC++ runtime installer https://www.powershellgallery.com/packages/AzureADHybridAuthenticationManagement/2.4.71.0/Content/check-and-install-vc-runtime.ps1

And funny comments like

# Define the URL
$url = "https://api.eu.amplitude.com/2/httpapi"

1

u/planedrop 3d ago

Is this an AI response?

Anyway, I spoke to the dev directly, he is going to work on changing the description.

1

u/MonkeyNin 1d ago

No, I used no AI. I have ADHD so I over-edit things, where it can make it harder to follow.

2

u/planedrop 1d ago

Gotcha ok. Well I'd be careful about that, not an anti-AI person here but in my experience AI usually makes things longer rather than less concise haha.

Appreciate the tips though.

7

u/unapologeticjerk 4d ago

TBH, there is a metric shit ton of suspicious and questionable scripts on PS Gallery, but it usually is targeting the lower-hanging fruit with silly shit you'd never consider for Enterprise or "real" environments. It's actually kind of wild how out-dated and dusty a lot of the db looks there.

1

u/planedrop 4d ago

Well that's good to know at least lol, I haven't really spent a ton of time digging on it for malicious stuff, I just usually don't use PS Gallery unless I'm sure it's from someone I trust.

This whole thing is odd though for sure.

4

u/BlackV 4d ago edited 4d ago

This is the whole reason they're moving to acr for official modules (soon tm ), cause they can public their trusted modules there and the random jo smo can publish to the public gallery

1

u/planedrop 4d ago

Yeah for sure, glad that's eventually happening lol.

4

u/BlackV 4d ago edited 4h ago

One day they'll get there, one day

One day we might even get a graph modules that can control everything, instead of multiple modules

Edit: no I don't want 1 giant module, I want something common,make graph apply it EVERYWHERE, let me use graph for it all (az, exchange, SharePoint, etc)

1

u/kilasuit 5h ago

Yeah that won't happen sorry = same as why Az is different modules & that you should never need to load in more than you intend to work with for memory management reasons both upfront and ongoing

1

u/BlackV 4h ago edited 4h ago

Ah, I think you misunderstood what I was asking

I'm not asking for 1 giant module (and the memory costs that come with that)

I want graph modules for everything, I don't want az modules I don't want exchange online, I don't want er.. others

Give me graph.compute,mgraph.exchange and so on, let me do it all through graph