etoro-auth

{"schema_version":"1.7.4","id":"MAL-2026-16114","published":"2026-09-10T04:43:38Z","modified":"2026-09-14T03:26:03.917954217Z","summary":"Malicious code in etoro-auth (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (385c1c361c59557137d095062a9f767a4c0cd0a1ef78b0b26e4654147e137e3c)\nThe package's preinstall.js runs automatically on `npm install` and collects host identifiers (os.hostname(), os.userInfo().username, process.cwd(), process.platform), sending them via HTTP GET to a hardcoded bare-IP endpoint at http://209.126.81.147/etoro-nuget-verify1f8eaa57a875/npm/v2/<hostname>/<user>/<platform>/<cwd>. It then executes `whoami`, `id`, and `hostname -f` (or `whoami /all` on Windows) via child_process and POSTs the command output to the same endpoint. The package's main entry (index.js) is empty; the only shipped behavior is the reconnaissance beacon. The package name and version (etoro-auth@99.0.0) together with the URL path segment `etoro-nuget-verify` fit a dependency-confusion probe targeting eToro's internal namespace, with the high version number used to win resolution against an internal package of the same name.\n\n## Source: ossf-package-analysis (de55cf40132e522735bf8195a1616bb5c19e2ca8a316ef7b807465d1b65208b9)\nThe OpenSSF Package Analysis project identified 'etoro-auth' @ 99.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"name":"etoro-auth","ecosystem":"npm"},"versions":["999.0.0","99.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"preinstall.js","sha256":"bee47062733940943fd3a66654f0258135fd62911674304ccac11a43226b5f58","tlsh":"ebe027f4118ca6683ccc01c4636b191ed4dfc705bcdec8c04a55d78587b15f1d6115f0"},{"path":"package.json","sha256":"5aec9699d328dadcfbff66a3724ff4c7b1b2db6d0e48d7be6f44fe4415f5c298","tlsh":"4bd0a7388a34a87369d403a15d63898676b50d5f00987c04179b205843b9b3f86bf60e"}],"package_integrity":[{"filename":"etoro-auth-999.0.0.tgz","hashes":{"sha1":"03ad51441a2888aa7af46f51af36e94519edaefd","sha512_sri":"sha512-SzyI9Fr1Ewo0E4p5WPkqQGiKcxsXLhkWTDJFLaxgt70krdof3C67jRErSCDqB84o/AgYITtz7Ee3DNkxCc37xA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/etoro-auth/v/999.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/etoro-auth/v/99.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019907","import_time":"2026-09-10T05:18:05.806423684Z","modified_time":"2026-09-10T04:43:38Z","sha256":"fa74d0f23335d017c81fa03793e5edc3571052772ad743ecbd476ce4049d8a0b","source":"amazon-inspector","versions":["999.0.0"]},{"id":"IN-MAL-2026-020002","import_time":"2026-09-11T18:21:32.211728975Z","modified_time":"2026-09-11T17:56:07Z","sha256":"385c1c361c59557137d095062a9f767a4c0cd0a1ef78b0b26e4654147e137e3c","source":"amazon-inspector","versions":["99.0.0"]},{"import_time":"2026-09-14T03:24:14.60810945Z","modified_time":"2026-09-11T14:11:12Z","sha256":"de55cf40132e522735bf8195a1616bb5c19e2ca8a316ef7b807465d1b65208b9","source":"ossf-package-analysis","versions":["99.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}