The etoro-aggregator npm package at version 999.0.0 includes a preinstall.js script that runs automatically on npm install. This script performs an HTTP GET request to a hardcoded attacker-controlled IP address (http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<hostname>/<username>/<cwd>), sending system information such as os.hostname(), os.userInfo().username, and process.cwd() as URL path segments. The package name and version suggest it is a dependency-confusion attack vector, aiming to collect host identity information for targeted follow-on attacks. There is no legitimate library code in the package, confirming its malicious intent.

Installing this package leaks sensitive host environment information (hostname, username, current working directory) to an attacker-controlled server over unencrypted HTTP. This reconnaissance data can be used by attackers to identify and target specific organizations or users for further attacks. No direct code execution beyond the preinstall script is described, and no known exploits in the wild have been reported.

No official patch or remediation is currently documented. Users should avoid installing the etoro-aggregator package version 999.0.0. Organizations should audit their internal package names to prevent dependency confusion attacks and consider using scoped packages or private registries to mitigate such risks. Monitor for unexpected packages with suspicious names during dependency installation.