opentelemetry-collector

No direct malware is evident in the supplied documentation or configuration examples. The primary security concern is the unverified download-and-execute bootstrap pattern using a mutable latest-release URL, combined with privileged MSI/service installation and storage of an API key in the service environment. The telemetry collection and Coralogix export are consistent with the stated purpose. Audit the actual PowerShell script and MSI, require signature or checksum verification, and protect service configuration containing the private key before deployment.

The supplied material is installation documentation rather than the installer source code. It does not provide evidence of malware, but its curl/Invoke-WebRequest-to-execution one-liners and mutable latest-release downloads create meaningful supply-chain and reproducibility risks. Review the actual scripts and verify release signatures or checksums before deployment; pin versions and restrict exposed Docker ports. Findings about implementation-specific malicious behavior remain unverified.