The etoro-api npm package at version 999.0.0 includes a preinstall.js script that auto-executes on installation. This script performs an HTTP GET request to a hardcoded bare-IP endpoint (http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<host>/<user>/<cwd>), embedding the installer's hostname, OS username, and current working directory in the URL path. The destination IP is unrelated to any legitimate eToro infrastructure, indicating malicious intent. The package name and unusually high version number are consistent with a dependency confusion attack, aiming to override internal private packages with a malicious public package.

Installation of [email protected] results in leakage of environment information (hostname, OS username, current working directory) to an attacker-controlled server. This can lead to reconnaissance for further attacks or targeted exploitation. The malicious package may also undermine supply chain integrity by masquerading as a legitimate internal package.

No official patch or remediation is currently documented. Users should avoid installing [email protected] and verify package sources carefully to prevent dependency confusion attacks. Monitor package dependencies for suspicious versions and names. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.