The 'etoro-builders' npm package at version 999.0.0 includes a preinstall lifecycle script (preinstall.js) that programmatically gathers sensitive environment details such as the OS hostname, username, and current working directory using Node.js APIs (os.hostname(), os.userInfo().username, process.cwd()). It then constructs a URL path embedding this data and issues an HTTP GET request to a hardcoded bare-IP endpoint (http://209.126.81.147/etoro-depconf-.../npm/<hostname>/<username>/<cwd>). The package's high version number and minimal content suggest it is a dependency confusion attack payload intended to override private internal packages and exfiltrate host identifiers to a third party during installation.

Installation of this package results in leakage of host-specific information (hostname, username, working directory) to an external third-party IP address over unencrypted HTTP. This exposure can aid attackers in reconnaissance and profiling of the compromised environment. No direct code execution or system compromise beyond data exfiltration is described. There are no known exploits in the wild at this time.

No official patch or remediation is indicated. Users should avoid installing the 'etoro-builders' package version 999.0.0. Verify package sources and avoid dependency confusion attacks by properly configuring package registries and scopes. Monitor for and remove any instances of this package if found in your environment. Since no vendor advisory or patch is provided, patch status is not yet confirmed — check vendor advisories or trusted sources for updates.