MAL-2026-16117

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (a35bbd75e3cc742fd88d59bcbb64858df0474505b5d6f93f10e8c727c718e129) The package's preinstall lifecycle script (preinstall.js) runs automatically on npm install and issues an HTTP GET to a hardcoded bare-IP endpoint at http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<host>/<user>/<cwd>, embedding os.hostname(), os.userInfo().username, and process.cwd() as URL path segments. The destination is not a first-party or registry host, uses plain HTTP, and the transmission is unconditional and undisclosed. The package name and implausibly high version number (999.0.0) combined with an 'eToro Infrastructure' author string are consistent with a dependency-confusion probe designed to identify internal build environments that resolve the public name in place of a private one.