etoro-analytics@999.0.0

OSV Malicious Advisory

imported 28d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16112 confirms this npm version as malicious. The package's preinstall lifecycle script runs automatically on `npm install` and sends the installer's hostname, OS username, and current working directory to a hardcoded remote host at http://209.126.81.147 over plain HTTP, embedding the values as URL path segments under `/etoro-depconf-poce346552f776f/npm/`...

Advisory

MAL-2026-16112

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in etoro-analytics (npm)

Details

The package's preinstall lifecycle script runs automatically on `npm install` and sends the installer's hostname, OS username, and current working directory to a hardcoded remote host at http://209.126.81.147 over plain HTTP, embedding the values as URL path segments under `/etoro-depconf-poce346552f776f/npm/`. The destination is a bare IP address, not configurable, and unrelated to any legitimate publisher infrastructure. The `999.0.0` version and eToro-themed name are consistent with a dependency-confusion lure targeting an internal package name.

Decision reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

etoro-analytics@999.0.0

OSV Malicious Advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code