MAL-2026-16117

    Dashboard / Malicious Package / MAL-2026-16117

    MAL-2026-16117

    Published: 10 Sept 2026Last Modified: 10 Sept 2026

    Summary: Malicious code in etoro-cashout (npm)

    Details: Source: amazon-inspector (a35bbd75e3cc742fd88d59bcbb64858df0474505b5d6f93f10e8c727c718e129) The package's preinstall lifecycle script (preinstall.js) runs automatically on npm install and issues an HTTP GET to a hardcoded bare-IP endpoint at http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<host>/<user>/<cwd>, embedding os.hostname(), os.userInfo().username, and process.cwd() as URL path segments. The destination is not a first-party or registry host, uses plain HTTP, and the transmission is unconditional and undisclosed. The package name and implausibly high version number (999.0.0) combined with an 'eToro Infrastructure' author string are consistent with a dependency-confusion probe designed to identify internal build environments that resolve the public name in place of a private one.

    References: https://www.npmjs.com/package/etoro-cashout/v/999.0.0

    Affected packages

    Package

    Name: etoro-cashout

    Purl: pkg:npm/etoro-cashout

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    999.0.0