registry / etoro-auth / 999.0.0

etoro-auth@999.0.0

OSV Malicious Advisory

imported 28d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16114 confirms this npm version as malicious. The package ships an empty library stub (index.js exports `{}`) alongside a preinstall lifecycle script that runs automatically on `npm install`. preinstall.js performs an unauthenticated plaintext HTTP GET to the hardcoded bare-IP endpoint http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<hostname>/<username>/<cwd>, transmitting the installer's OS hostname, OS username, and current working directory as URL...

Advisory

MAL-2026-16114

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in etoro-auth (npm)

Details

The package ships an empty library stub (index.js exports `{}`) alongside a preinstall lifecycle script that runs automatically on `npm install`. preinstall.js performs an unauthenticated plaintext HTTP GET to the hardcoded bare-IP endpoint http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<hostname>/<username>/<cwd>, transmitting the installer's OS hostname, OS username, and current working directory as URL path segments. The package name resembles an eToro internal authentication client and is published at version 999.0.0 with no functional code, a shape consistent with dependency-confusion reconnaissance intended to resolve inside eToro build systems and report back which internal hosts pulled the public lure.

Decision reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

Network

Supply chain

TrivialUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 315 B of source, external domains: 209.126.81.147

Source & flagged code

2 flagged

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to etoro-auth@999.0.0.

See version security history for other recorded verdicts.

Avoid installing etoro-auth@999.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-10 05:30:11.584Z (UTC).

Source advisory published: 2026-09-10 04:43:38.000Z (UTC).