MAL-2026-16111

    Dashboard / Malicious Package / MAL-2026-16111

    MAL-2026-16111

    Published: 10 Sept 2026Last Modified: 11 Sept 2026

    Summary: Malicious code in etoro-aggregator (npm)

    Details: Source: amazon-inspector (d7d5f0fb8c06c23afad28686a3d3d689dfc5a3786c73bff2c569fd8b55f2b4ad) The package's preinstall.js lifecycle script executes automatically on `npm install` and performs reconnaissance on the installer host. It collects hostname, username, current working directory, platform, and the output of OS commands including `whoami /all`, `ipconfig /all` / `ifconfig`, `tasklist` / `ps aux`, directory listings of `/`, `C:\`, and the user's home, and a dump of environment variables. The collected data is transmitted via HTTP GET and POST to the hardcoded bare IP endpoint `http://209.126.81.147/etoro-nuget-verify1f8eaa57a875/v4/...`. The package's declared main is an empty stub and its description ("Internal service client library") combined with the implausibly high version number `99.0.2` is consistent with a dependency-confusion attack targeting an internal `etoro-aggregator` name. The manifest plus the preinstall script constitute the entire payload; installing the package leaks installer host identity, network configuration, filesystem structure, and environment variables (which routinely contain credentials and tokens) to an attacker-controlled endpoint.

    References: https://www.npmjs.com/package/etoro-aggregator/v/999.0.0, https://www.npmjs.com/package/etoro-aggregator/v/99.0.2, https://www.npmjs.com/package/etoro-aggregator/v/99.0.0

    Affected packages

    Package

    Name: etoro-aggregator

    Purl: pkg:npm/etoro-aggregator

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    999.0.0