registry / etoro-charts / 999.0.0

etoro-charts@999.0.0

OSV Malicious Advisory

imported 28d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16118 confirms this npm version as malicious. The package's preinstall.js runs automatically on npm install and issues an HTTP GET to a hardcoded bare IP (http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<hostname>/<username>/<cwd>), embedding the installer's OS hostname (os.hostname()), OS username (os.userInfo().username), and current working directory (process.cwd()) as URL path segments...

Advisory

MAL-2026-16118

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in etoro-charts (npm)

Details

The package's preinstall.js runs automatically on npm install and issues an HTTP GET to a hardcoded bare IP (http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<hostname>/<username>/<cwd>), embedding the installer's OS hostname (os.hostname()), OS username (os.userInfo().username), and current working directory (process.cwd()) as URL path segments. The package uses a generic 'eToro' brand name with a version pinned at 999.0.0, a pattern consistent with dependency-confusion attacks that aim to win resolution against an internal package of the same name. Installing the package causes installer-side identifiers to be sent in cleartext to an attacker-controlled endpoint.

Decision reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

Network

Supply chain

TrivialUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 315 B of source, external domains: 209.126.81.147

Source & flagged code

2 flagged

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to etoro-charts@999.0.0.

See version security history for other recorded verdicts.

Avoid installing etoro-charts@999.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-10 05:30:11.796Z (UTC).

Source advisory published: 2026-09-10 04:43:46.000Z (UTC).