The 'etoro-auth' npm package at version 999.0.0 is a malicious package that ships an empty library stub but includes a preinstall lifecycle script. This script runs automatically on 'npm install' and sends sensitive environment information—specifically the OS hostname, OS username, and current working directory—via an unauthenticated plaintext HTTP GET request to a hardcoded IP address (http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<hostname>/<username>/<cwd>). The package name mimics an internal eToro authentication client, consistent with a dependency confusion attack intended to detect which internal hosts pull this package from the public npm registry.

The package leaks sensitive environment information (hostname, username, current working directory) to an external attacker-controlled server during installation. This information disclosure can aid attackers in reconnaissance and further targeted attacks. There is no functional code, so no direct code execution or payload delivery beyond the data exfiltration performed by the preinstall script.

No official patch or remediation is indicated. Users should avoid installing the 'etoro-auth' package version 999.0.0 from public npm registries. Organizations should audit their dependency sources to prevent dependency confusion attacks by ensuring internal packages are not resolvable from public registries. Monitoring and blocking outbound HTTP requests to suspicious IP addresses during package installation can also help mitigate data leakage.