Malicious code in etoro-cashout (npm)
Affects etoro-cashoutSource GCVE Database
Rated by Threat Radar
Data as of 09/11/2026, 22:10:49 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmetoro-cashout | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should avoid installing the 'etoro-cashout' package version 999.0.0. Review and restrict usage of untrusted or suspicious npm packages, especially those with unusual version numbers or author metadata. Monitor for and remove this package from development and build environments. Verify internal package resolution to prevent dependency confusion attacks.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c8aa14d0b9945053b63f4396f09365c5daefec60a25e931f165b3473e7c564f1) The package's preinstall.js lifecycle script runs on npm install and executes host reconnaissance commands (whoami, ipconfig/ip addr, directory listings of C:\ and /, tasklist/ps, and a full environment-variable dump via set/env) and POSTs the collected output over plain HTTP to a hardcoded remote server at 209.126.81.147, using path segments under a canary token 'etoro-nuget-verify1f8eaa57a875'. The package name 'etoro-cashout' at version 99.0.2, the eToro-branded canary, and the beacon path shape are consistent with a dependency-confusion probe targeting an internal eToro registry: any build environment that resolves this public name executes the exfiltration on install. Data leaving the installer includes hostname, username, working directory, filesystem listings, running processes, and the full process environment, which on CI systems routinely contains cloud credentials, registry tokens, and API keys.
Impact
The malicious preinstall script leaks sensitive environment details such as hostname, username, and working directory to an external attacker-controlled server. This information disclosure can aid attackers in identifying and targeting internal build environments or developer machines. There is no indication of further exploitation or payload delivery beyond this reconnaissance behavior.
Summary
The 'etoro-cashout' npm package version 999.0.0 includes a preinstall.js script that runs automatically on installation. This script issues an HTTP GET request to a hardcoded bare-IP address (http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<host>/<user>/<cwd>) transmitting the system's hostname, user information, and current working directory as URL path segments. The destination is not affiliated with the official registry or first-party hosts and uses unencrypted HTTP. The package's naming and versioning suggest it is a dependency-confusion attack probe designed to detect internal environments that mistakenly resolve the public package instead of a private one.