registry / etoro-client / 999.0.0

etoro-client@999.0.0

OSV Malicious Advisory

imported 1mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16119 confirms this npm version as malicious. The preinstall lifecycle script in etoro-client@999.0.0 unconditionally sends the installer's hostname, OS username, and current working directory to the hardcoded bare-IP endpoint http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<host>/<user>/<cwd> over plain HTTP at `npm install` time. The package name combined with the implausibly high 999.0.0 version and the `depconf` path token indicate a...

Advisory

MAL-2026-16119

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in etoro-client (npm)

Details

The preinstall lifecycle script in etoro-client@999.0.0 unconditionally sends the installer's hostname, OS username, and current working directory to the hardcoded bare-IP endpoint http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<host>/<user>/<cwd> over plain HTTP at `npm install` time. The package name combined with the implausibly high 999.0.0 version and the `depconf` path token indicate a dependency-confusion attack targeting an internal `etoro-client` package: publishing a high-version public namesake so that misconfigured resolvers pull this artifact instead of the private internal one. The preinstall beacon then confirms successful landing on a target and identifies the host, user, and build path.

Decision reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

Network

Supply chain

TrivialUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 315 B of source, external domains: 209.126.81.147

Source & flagged code

2 flagged

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to etoro-client@999.0.0.

See version security history for other recorded verdicts.

Avoid installing etoro-client@999.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-10 05:30:11.582Z (UTC).

Source advisory published: 2026-09-10 04:44:04.000Z (UTC).