registry / etoro-auth / 99.0.0

etoro-auth@99.0.0

Internal service client library

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Installing the package automatically fingerprints the host and exfiltrates local identity-command output. The behavior is unrelated to its empty runtime module.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation invokes the preinstall lifecycle hook.

Impact

An external server receives the local account identity, host details, working directory, and identity-command output.

Mechanism

Install-time system discovery and HTTP exfiltration.

Attack narrative

On installation, package.json runs preinstall.js. That script collects the hostname, user name, platform, and current directory and sends them in an HTTP request to a hard-coded external IP address. It then runs whoami and id-related commands and posts the resulting identity information to that server. The lifecycle command ignores errors, reducing visibility of failed collection or transmission.

AI rationale

This is unconsented install-time collection and exfiltration of host and user identity data to an unrelated external IP address. The empty runtime module provides no legitimate package function that explains this behavior.

Evidence

package.jsonpreinstall.js

Network endpoints2

209.126.81.147/etoro-nuget-verify1f8eaa57a875/npm/v2/209.126.81.147

OSV advisory

The package's preinstall.js runs automatically on `npm install` and collects host identifiers (os.hostname(), os.userInfo().username, process.cwd(), process.platform), sending them via HTTP GET to a hardcoded bare-IP endpoint at http://209.126.81.147/etoro-nuget-verify1f8eaa57a875/npm/v2/<hostname>/<user>/<platform>/<cwd>. It then executes `whoami`, `id`, and `hostname -f` (or `whoami /all` on Windows) via child_process and POSTs the command output to the same endpoint. The package's main entry (index.js) is empty; the only shipped behavior is the reconnaissance beacon. The package name and version (etoro-auth@99.0.0) together with the URL path segment `etoro-nuget-verify` fit a dependency-confusion probe targeting eToro's internal namespace, with the high version number used to win resolution against an internal package of the same name. ## Source: ossf-package-analysis (de55cf40132e522735bf8195a1616bb5c19e2ca8a316ef7b807465d1b65208b9) The OpenSSF Package Analysis project identified 'etoro-auth' @ 99.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

etoro-auth@99.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code