registry / etoro-core / 999.0.0

etoro-core@999.0.0

OSV Malicious Advisory

imported 1mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16120 confirms this npm version as malicious. The package's preinstall lifecycle script (preinstall.js) issues an HTTP GET to the hardcoded bare-IP endpoint http://209.126.81.147/etoro-depconf-poce346552f776f/npm/ with os.hostname(), os.userInfo().username, and process.cwd() embedded in the URL path. This runs automatically on `npm install` and transmits installer host identity over plaintext HTTP to an attacker-controlled destination...

Advisory

MAL-2026-16120

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in etoro-core (npm)

Details

The package's preinstall lifecycle script (preinstall.js) issues an HTTP GET to the hardcoded bare-IP endpoint http://209.126.81.147/etoro-depconf-poce346552f776f/npm/ with os.hostname(), os.userInfo().username, and process.cwd() embedded in the URL path. This runs automatically on `npm install` and transmits installer host identity over plaintext HTTP to an attacker-controlled destination. The package name and inflated 999.0.0 version are consistent with a dependency-confusion payload targeting an internal `etoro-core` name.

Decision reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

Network

Supply chain

TrivialUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 315 B of source, external domains: 209.126.81.147

Source & flagged code

2 flagged

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.preinstall = node preinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node preinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to etoro-core@999.0.0.

See version security history for other recorded verdicts.

Avoid installing etoro-core@999.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-10 05:30:11.591Z (UTC).

Source advisory published: 2026-09-10 04:43:55.000Z (UTC).