MAL-2026-16114

Dashboard / Malicious Package / MAL-2026-16114

MAL-2026-16114

Summary: Malicious code in etoro-auth (npm)

Details: Source: amazon-inspector (385c1c361c59557137d095062a9f767a4c0cd0a1ef78b0b26e4654147e137e3c) The package's preinstall.js runs automatically on `npm install` and collects host identifiers (os.hostname(), os.userInfo().username, process.cwd(), process.platform), sending them via HTTP GET to a hardcoded bare-IP endpoint at http://209.126.81.147/etoro-nuget-verify1f8eaa57a875/npm/v2/<hostname>/<user>/<platform>/<cwd>. It then executes `whoami`, `id`, and `hostname -f` (or `whoami /all` on Windows) via child_process and POSTs the command output to the same endpoint. The package's main entry (index.js) is empty; the only shipped behavior is the reconnaissance beacon. The package name and version ([email protected]) together with the URL path segment `etoro-nuget-verify` fit a dependency-confusion probe targeting eToro's internal namespace, with the high version number used to win resolution against an internal package of the same name. Source: ossf-package-analysis (de55cf40132e522735bf8195a1616bb5c19e2ca8a316ef7b807465d1b65208b9) The OpenSSF Package Analysis project identified 'etoro-auth' @ 99.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

References: https://www.npmjs.com/package/etoro-auth/v/999.0.0, https://www.npmjs.com/package/etoro-auth/v/99.0.0