MalwarePublished 10 Sep 2026Updated 14 Sep 2026

etoro-auth (npm) · Malicious Code

Affects etoro-authSource GCVE Database

Malicious package : remove etoro-auth and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:19 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-16114

What to do

Remove etoro-auth from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmetoro-auth	Affected =999.0.0 =99.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (385c1c361c59557137d095062a9f767a4c0cd0a1ef78b0b26e4654147e137e3c) The package's preinstall.js runs automatically on `npm install` and collects host identifiers (os.hostname(), os.userInfo().username, process.cwd(), process.platform), sending them via HTTP GET to a hardcoded bare-IP endpoint at http://209.126.81.147/etoro-nuget-verify1f8eaa57a875/npm/v2/<hostname>/<user>/<platform>/<cwd>. It then executes `whoami`, `id`, and `hostname -f` (or `whoami /all` on Windows) via child_process and POSTs the command output to the same endpoint. The package's main entry (index.js) is empty; the only shipped behavior is the reconnaissance beacon. The package name and version (etoro-auth@99.0.0) together with the URL path segment `etoro-nuget-verify` fit a dependency-confusion probe targeting eToro's internal namespace, with the high version number used to win resolution against an internal package of the same name.

Impact

The package leaks sensitive environment information (hostname, username, current working directory) to an external attacker-controlled server during installation. This information disclosure can aid attackers in reconnaissance and further targeted attacks. There is no functional code, so no direct code execution or payload delivery beyond the data exfiltration performed by the preinstall script.

Defensive guidance

Users should avoid installing the 'etoro-auth' package version 999.0.0 from public npm registries. Organizations should audit their dependency sources to prevent dependency confusion attacks by ensuring internal packages are not resolvable from public registries. Monitoring and blocking outbound HTTP requests to suspicious IP addresses during package installation can also help mitigate data leakage.

Summary

The 'etoro-auth' npm package at version 999.0.0 is a malicious package that ships an empty library stub but includes a preinstall lifecycle script. This script runs automatically on 'npm install' and sends sensitive environment information—specifically the OS hostname, OS username, and current working directory—via an unauthenticated plaintext HTTP GET request to a hardcoded IP address (http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<hostname>/<username>/<cwd>). The package name mimics an internal eToro authentication client, consistent with a dependency confusion attack intended to detect which internal hosts pull this package from the public npm registry.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Sep 2026, 13:39 UTC

Technical details

References

Community reviews