The 'etoro-analytics' npm package version 999.0.0 includes a preinstall script that exfiltrates the installer's hostname, OS username, and current working directory to a fixed remote IP address (http://209.126.81.147) via plain HTTP. This behavior occurs automatically upon running 'npm install'. The package name and version suggest it is designed as a dependency confusion attack, targeting internal package names by masquerading as a legitimate package. There is no indication that this package is affiliated with the legitimate eToro infrastructure. No CVSS score or vendor advisory is provided.

Installation of this package results in disclosure of local environment information (hostname, OS username, working directory) to an attacker-controlled server. This can lead to privacy breaches and may facilitate further targeted attacks. The use of plain HTTP means the data is transmitted unencrypted, increasing exposure risk. There is no evidence of further payloads or exploitation beyond this data exfiltration in the provided information.

No official patch or remediation guidance is available. Users should avoid installing the 'etoro-analytics' package version 999.0.0 from untrusted sources. Verify package authenticity before installation, especially for packages with suspicious versioning or naming patterns indicative of dependency confusion attacks. Monitor and audit package dependencies to prevent accidental installation of malicious packages.