Malicious code in etoro-builders (npm)
Affects etoro-buildersSource GCVE Database
Rated by Threat Radar
Data as of 09/10/2026, 13:39:04 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmetoro-builders | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should avoid installing the 'etoro-builders' package version 999.0.0. Verify package sources and avoid dependency confusion attacks by properly configuring package registries and scopes. Monitor for and remove any instances of this package if found in your environment.
Description
The npm package 'etoro-builders' version 999.0.0 contains malicious code in its preinstall script that collects the installer's OS hostname, username, and current working directory. This information is encoded into a URL path and sent via an HTTP GET request to a hardcoded external IP address over unencrypted HTTP. The package appears to be a dependency confusion payload designed to masquerade as an internal package and report successful installations to an external operator.
Impact
Installation of this package results in leakage of host-specific information (hostname, username, working directory) to an external third-party IP address over unencrypted HTTP. This exposure can aid attackers in reconnaissance and profiling of the compromised environment. No direct code execution or system compromise beyond data exfiltration is described. There are no known exploits in the wild at this time.
Summary
The 'etoro-builders' npm package at version 999.0.0 includes a preinstall lifecycle script (preinstall.js) that programmatically gathers sensitive environment details such as the OS hostname, username, and current working directory using Node.js APIs (os.hostname(), os.userInfo().username, process.cwd()). It then constructs a URL path embedding this data and issues an HTTP GET request to a hardcoded bare-IP endpoint (http://209.126.81.147/etoro-depconf-.../npm/<hostname>/<username>/<cwd>). The package's high version number and minimal content suggest it is a dependency confusion attack payload intended to override private internal packages and exfiltrate host identifiers to a third party during installation.