MAL-2026-16114

    Dashboard / Malicious Package / MAL-2026-16114

    MAL-2026-16114

    Published: 10 Sept 2026Last Modified: 10 Sept 2026

    Summary: Malicious code in etoro-auth (npm)

    Details: Source: amazon-inspector (fa74d0f23335d017c81fa03793e5edc3571052772ad743ecbd476ce4049d8a0b) The package ships an empty library stub (index.js exports `{}`) alongside a preinstall lifecycle script that runs automatically on `npm install`. preinstall.js performs an unauthenticated plaintext HTTP GET to the hardcoded bare-IP endpoint http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<hostname>/<username>/<cwd>, transmitting the installer's OS hostname, OS username, and current working directory as URL path segments. The package name resembles an eToro internal authentication client and is published at version 999.0.0 with no functional code, a shape consistent with dependency-confusion reconnaissance intended to resolve inside eToro build systems and report back which internal hosts pulled the public lure.

    References: https://www.npmjs.com/package/etoro-auth/v/999.0.0

    Affected packages

    Package

    Name: etoro-auth

    Purl: pkg:npm/etoro-auth

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    999.0.0