registry / etoro-aggregator / 99.0.2

etoro-aggregator@99.0.2

Internal service client library

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Installing the package triggers host reconnaissance and exfiltration. It uploads system, process, directory, and environment data to an external IP address.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation

Impact

Sensitive environment values, host identity, running-process data, and filesystem metadata may be exposed.

Mechanism

preinstall command execution with HTTP data exfiltration

Attack narrative

During npm preinstall, the package runs operating-system commands to gather identity, network, process, directory, and environment information. It then posts the results to 209.126.81.147 over HTTP. The lifecycle command hides failures, allowing the package installation to continue after attempted collection.

AI rationale

This is concrete, unconsented install-time system reconnaissance and data exfiltration with no legitimate runtime implementation. The package should be blocked.

Evidence

package.jsonpreinstall.js

Network endpoints1

209.126.81.147

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-16111

Source

OpenSSF Malicious Packages via OSV

The package's preinstall.js lifecycle script executes automatically on `npm install` and performs reconnaissance on the installer host. It collects hostname, username, current working directory, platform, and the output of OS commands including `whoami /all`, `ipconfig /all` / `ifconfig`, `tasklist` / `ps aux`, directory listings of `/`, `C:\`, and the user's home, and a dump of environment variables. The collected data is transmitted via HTTP GET and POST to the hardcoded bare IP endpoint `http://209.126.81.147/etoro-nuget-verify1f8eaa57a875/v4/...`. The package's declared main is an empty stub and its description ("Internal service client library") combined with the implausibly high version number `99.0.2` is consistent with a dependency-confusion attack targeting an internal `etoro-aggregator` name. The manifest plus the preinstall script constitute the entire payload; installing the package leaks installer host identity, network configuration, filesystem structure, and environment variables (which routinely contain credentials and tokens) to an attacker-controlled endpoint.

etoro-aggregator@99.0.2

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code