{"id":"MAL-2026-16113","revision":"ef0ae4e19b5743efb9e646e71bc2b84d","records":[{"revision":"ef0ae4e19b5743efb9e646e71bc2b84d","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-16113","aliases":[],"title":"Malicious code in etoro-api (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ab6228f994962694d4434f53d20d6a5a1b877b39a3498236327da9d0385284d9)\nThe preinstall lifecycle script in etoro-api@999.0.0 (preinstall.js) auto-executes on npm install and performs an HTTP GET to a hardcoded bare-IP endpoint at http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<host>/<user>/<cwd>, embedding the installer's hostname (os.hostname()), OS username (os.userInfo().username), and current working directory (process.cwd()) as URL path components. The destination is a plain-HTTP bare-IP host unrelated to any legitimate eToro publishing infrastructure. The package name combined with the implausibly high version number (999.0.0) is the canonical dependency-confusion shape used to force resolution over an internal private package of the same name.\n","state":0,"publishedAt":"2026-09-10T04:44:16+00:00","modifiedAt":"2026-09-10T05:30:11.5898001+00:00","affected":[{"ecosystem":"npm","name":"etoro-api","ranges":[],"versions":["999.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/etoro-api/v/999.0.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-16113","license":"OSV · upstream source license applies","key":"osv:MAL-2026-16113","identifiers":["MAL-2026-16113"]},"retained":false,"historicalAffected":[]}],"coverage":[]}