{"id":"MAL-2026-16114","summary":"Malicious code in etoro-auth (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (385c1c361c59557137d095062a9f767a4c0cd0a1ef78b0b26e4654147e137e3c)\nThe package's preinstall.js runs automatically on `npm install` and collects host identifiers (os.hostname(), os.userInfo().username, process.cwd(), process.platform), sending them via HTTP GET to a hardcoded bare-IP endpoint at http://209.126.81.147/etoro-nuget-verify1f8eaa57a875/npm/v2/\u003chostname\u003e/\u003cuser\u003e/\u003cplatform\u003e/\u003ccwd\u003e. It then executes `whoami`, `id`, and `hostname -f` (or `whoami /all` on Windows) via child_process and POSTs the command output to the same endpoint. The package's main entry (index.js) is empty; the only shipped behavior is the reconnaissance beacon. The package name and version (etoro-auth@99.0.0) together with the URL path segment `etoro-nuget-verify` fit a dependency-confusion probe targeting eToro's internal namespace, with the high version number used to win resolution against an internal package of the same name.\n","modified":"2026-09-11T18:45:05.159373237Z","published":"2026-09-10T04:43:38Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019907","import_time":"2026-09-10T05:18:05.806423684Z","modified_time":"2026-09-10T04:43:38Z","sha256":"fa74d0f23335d017c81fa03793e5edc3571052772ad743ecbd476ce4049d8a0b","source":"amazon-inspector","versions":["999.0.0"]},{"versions":["99.0.0"],"id":"IN-MAL-2026-020002","import_time":"2026-09-11T18:21:32.211728975Z","modified_time":"2026-09-11T17:56:07Z","sha256":"385c1c361c59557137d095062a9f767a4c0cd0a1ef78b0b26e4654147e137e3c","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/etoro-auth/v/999.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/etoro-auth/v/99.0.0"}],"affected":[{"package":{"name":"etoro-auth","ecosystem":"npm","purl":"pkg:npm/etoro-auth"},"versions":["999.0.0","99.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/etoro-auth/MAL-2026-16114.json","indicators":{"package_integrity":[{"filename":"etoro-auth-999.0.0.tgz","hashes":{"sha1":"03ad51441a2888aa7af46f51af36e94519edaefd","sha512_sri":"sha512-SzyI9Fr1Ewo0E4p5WPkqQGiKcxsXLhkWTDJFLaxgt70krdof3C67jRErSCDqB84o/AgYITtz7Ee3DNkxCc37xA=="}}],"evidence_files":[{"sha256":"bee47062733940943fd3a66654f0258135fd62911674304ccac11a43226b5f58","tlsh":"ebe027f4118ca6683ccc01c4636b191ed4dfc705bcdec8c04a55d78587b15f1d6115f0","path":"preinstall.js"},{"path":"package.json","sha256":"5aec9699d328dadcfbff66a3724ff4c7b1b2db6d0e48d7be6f44fe4415f5c298","tlsh":"4bd0a7388a34a87369d403a15d63898676b50d5f00987c04179b205843b9b3f86bf60e"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}