Malicious code in etoro-api (npm)
Historical advisory saved 24 Oct 2026 13:17:17 UTC. The publisher may have updated it since then. Latest advisory.
osv · MAL-2026-16113
Published--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ab6228f994962694d4434f53d20d6a5a1b877b39a3498236327da9d0385284d9) The preinstall lifecycle script in [email protected] (preinstall.js) auto-executes on npm install and performs an HTTP GET to a hardcoded bare-IP endpoint at http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<host>/<user>/<cwd>, embedding the installer's hostname (os.hostname()), OS username (os.userInfo().username), and current working directory (process.cwd()) as URL path components. The destination is a plain-HTTP bare-IP host unrelated to any legitimate eToro publishing infrastructure. The package name combined with the implausibly high version number (999.0.0) is the canonical dependency-confusion shape used to force resolution over an internal private package of the same name.
- Source published
- 10 Sep 2026 04:44:16 UTC
- Source modified
- 10 Sep 2026 05:30:11 UTC
- Saved here
- 24 Oct 2026 13:17:17 UTC
- Source terms
- OSV · upstream source license applies
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.