Malicious code in etoro-billing (npm)
Affects etoro-billingSource GCVE Database
Rated by Threat Radar
Data as of 09/10/2026, 13:39:56 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmetoro-billing | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should avoid installing the 'etoro-billing' package version 999.0.0 from npm. Monitor package sources carefully and prefer verified official packages.
Description
The npm package 'etoro-billing' version 999.0.0 contains malicious code that executes during installation. Its preinstall script collects system information such as hostname, username, and current working directory, then sends this data via an unencrypted HTTP request to a hardcoded IP address unrelated to eToro. The package exports no functional code, indicating its primary purpose is to beacon identifying information. This package uses a high version number to potentially override legitimate internal packages with the same name, a technique known as dependency confusion.
Impact
The primary impact is the unauthorized disclosure of system environment information (hostname, username, working directory) to an external, untrusted IP address. This could aid attackers in reconnaissance or further targeted attacks. No direct code execution beyond the preinstall script is indicated, and no additional payload or exploit is described. There is no evidence of active exploitation in the wild.
Summary
The 'etoro-billing' npm package version 999.0.0 includes a preinstall lifecycle hook that runs a script reading local system details (hostname, username, current working directory) and sends them in an HTTP GET request to a hardcoded IP address (http://209.126.81.147). The package's main module is an empty stub, so no legitimate functionality is provided. The use of a very high version number suggests an attempt to supersede legitimate internal packages by dependency confusion. This behavior constitutes malicious code designed to exfiltrate environment identifiers during package installation.