Malicious code in etoro-billing (npm)
The npm package 'etoro-billing' version 999.0.0 contains malicious code that executes during installation. Its preinstall script collects system information such as hostname, username, and current working directory, then sends this data via an unencrypted HTTP request to a hardcoded IP address unrelated to eToro. The package exports no functional code, indicating its primary purpose is to beacon identifying information. This package uses a high version number to potentially override legitimate internal packages with the same name, a technique known as dependency confusion.
AI Analysis
Technical Summary
The 'etoro-billing' npm package version 999.0.0 includes a preinstall lifecycle hook that runs a script reading local system details (hostname, username, current working directory) and sends them in an HTTP GET request to a hardcoded IP address (http://209.126.81.147). The package's main module is an empty stub, so no legitimate functionality is provided. The use of a very high version number suggests an attempt to supersede legitimate internal packages by dependency confusion. This behavior constitutes malicious code designed to exfiltrate environment identifiers during package installation.
Potential Impact
The primary impact is the unauthorized disclosure of system environment information (hostname, username, working directory) to an external, untrusted IP address. This could aid attackers in reconnaissance or further targeted attacks. No direct code execution beyond the preinstall script is indicated, and no additional payload or exploit is described. There is no evidence of active exploitation in the wild.
Mitigation Recommendations
Users should avoid installing the 'etoro-billing' package version 999.0.0 from npm. Since no patch or official fix is available, the best mitigation is to remove or block this package from dependency resolution and verify internal package namespaces to prevent dependency confusion attacks. Monitor package sources carefully and prefer verified official packages. Patch status is not yet confirmed — check vendor advisories or trusted sources for updates.
Malicious code in etoro-billing (npm)
Description
The npm package 'etoro-billing' version 999.0.0 contains malicious code that executes during installation. Its preinstall script collects system information such as hostname, username, and current working directory, then sends this data via an unencrypted HTTP request to a hardcoded IP address unrelated to eToro. The package exports no functional code, indicating its primary purpose is to beacon identifying information. This package uses a high version number to potentially override legitimate internal packages with the same name, a technique known as dependency confusion.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'etoro-billing' npm package version 999.0.0 includes a preinstall lifecycle hook that runs a script reading local system details (hostname, username, current working directory) and sends them in an HTTP GET request to a hardcoded IP address (http://209.126.81.147). The package's main module is an empty stub, so no legitimate functionality is provided. The use of a very high version number suggests an attempt to supersede legitimate internal packages by dependency confusion. This behavior constitutes malicious code designed to exfiltrate environment identifiers during package installation.
Potential Impact
The primary impact is the unauthorized disclosure of system environment information (hostname, username, working directory) to an external, untrusted IP address. This could aid attackers in reconnaissance or further targeted attacks. No direct code execution beyond the preinstall script is indicated, and no additional payload or exploit is described. There is no evidence of active exploitation in the wild.
Mitigation Recommendations
Users should avoid installing the 'etoro-billing' package version 999.0.0 from npm. Since no patch or official fix is available, the best mitigation is to remove or block this package from dependency resolution and verify internal package namespaces to prevent dependency confusion attacks. Monitor package sources carefully and prefer verified official packages. Patch status is not yet confirmed — check vendor advisories or trusted sources for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-16115
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6aa2af89acd9273b4925b530
Added to database: 09/10/2026, 13:24:25 UTC
Last enriched: 09/10/2026, 13:39:56 UTC
Last updated: 09/10/2026, 13:46:11 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.