The 'etoro-cashout' npm package version 999.0.0 includes a preinstall.js script that runs automatically on installation. This script issues an HTTP GET request to a hardcoded bare-IP address (http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<host>/<user>/<cwd>) transmitting the system's hostname, user information, and current working directory as URL path segments. The destination is not affiliated with the official registry or first-party hosts and uses unencrypted HTTP. The package's naming and versioning suggest it is a dependency-confusion attack probe designed to detect internal environments that mistakenly resolve the public package instead of a private one.

The malicious preinstall script leaks sensitive environment details such as hostname, username, and working directory to an external attacker-controlled server. This information disclosure can aid attackers in identifying and targeting internal build environments or developer machines. There is no indication of further exploitation or payload delivery beyond this reconnaissance behavior.

No official patch or remediation is currently documented. Users should avoid installing the 'etoro-cashout' package version 999.0.0. Review and restrict usage of untrusted or suspicious npm packages, especially those with unusual version numbers or author metadata. Monitor for and remove this package from development and build environments. Verify internal package resolution to prevent dependency confusion attacks. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.