MAL-2026-16114
Malicious code in etoro-auth (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (fa74d0f23335d017c81fa03793e5edc3571052772ad743ecbd476ce4049d8a0b) The package ships an empty library stub (index.js exports `{}`) alongside a preinstall lifecycle script that runs automatically on `npm install`. preinstall.js performs an unauthenticated plaintext HTTP GET to the hardcoded bare-IP endpoint http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<hostname>/<username>/<cwd>, transmitting the installer's OS hostname, OS username, and current working directory as URL path segments. The package name resembles an eToro internal authentication client and is published at version 999.0.0 with no functional code, a shape consistent with dependency-confusion reconnaissance intended to resolve inside eToro build systems and report back which internal hosts pulled the public lure.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for etoro-auth (npm). Pin to a known-safe version or switch to an alternative.