Malicious code in etoro-charts (npm)
The npm package 'etoro-charts' version 999.0.0 contains malicious code in its preinstall.js script that executes automatically during installation. This script sends an HTTP GET request to a hardcoded attacker-controlled IP address, transmitting the installer's OS hostname, username, and current working directory in cleartext. The package uses a generic 'eToro' brand name and a suspiciously high version number, consistent with dependency confusion attack techniques. This behavior exposes sensitive environment information to an external entity without user consent.
AI Analysis
Technical Summary
The 'etoro-charts' npm package version 999.0.0 includes a preinstall.js script that runs automatically upon installation. This script performs an HTTP GET request to a hardcoded IP address (http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<hostname>/<username>/<cwd>), embedding the installer's OS hostname, username, and current working directory as URL path segments. The package's naming and versioning pattern suggest it is designed for dependency confusion attacks, aiming to override legitimate internal packages. The transmission of installer environment details to an attacker-controlled endpoint constitutes a privacy and security risk.
Potential Impact
Installing this package leaks sensitive environment information—specifically the OS hostname, username, and current working directory—to an attacker-controlled server in cleartext. This information disclosure can aid attackers in profiling the victim's environment and potentially facilitate further targeted attacks. There is no indication of code execution beyond the preinstall script or direct system compromise from the provided data.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing the 'etoro-charts' package version 999.0.0 from untrusted sources. Verify package authenticity before installation and consider using scoped or private registries to prevent dependency confusion attacks. Monitor for updates or advisories from trusted sources regarding this package.
Malicious code in etoro-charts (npm)
Description
The npm package 'etoro-charts' version 999.0.0 contains malicious code in its preinstall.js script that executes automatically during installation. This script sends an HTTP GET request to a hardcoded attacker-controlled IP address, transmitting the installer's OS hostname, username, and current working directory in cleartext. The package uses a generic 'eToro' brand name and a suspiciously high version number, consistent with dependency confusion attack techniques. This behavior exposes sensitive environment information to an external entity without user consent.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'etoro-charts' npm package version 999.0.0 includes a preinstall.js script that runs automatically upon installation. This script performs an HTTP GET request to a hardcoded IP address (http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<hostname>/<username>/<cwd>), embedding the installer's OS hostname, username, and current working directory as URL path segments. The package's naming and versioning pattern suggest it is designed for dependency confusion attacks, aiming to override legitimate internal packages. The transmission of installer environment details to an attacker-controlled endpoint constitutes a privacy and security risk.
Potential Impact
Installing this package leaks sensitive environment information—specifically the OS hostname, username, and current working directory—to an attacker-controlled server in cleartext. This information disclosure can aid attackers in profiling the victim's environment and potentially facilitate further targeted attacks. There is no indication of code execution beyond the preinstall script or direct system compromise from the provided data.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing the 'etoro-charts' package version 999.0.0 from untrusted sources. Verify package authenticity before installation and consider using scoped or private registries to prevent dependency confusion attacks. Monitor for updates or advisories from trusted sources regarding this package.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-16118
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6aa2af89acd9273b4925b52c
Added to database: 09/10/2026, 13:24:25 UTC
Last enriched: 09/10/2026, 13:39:48 UTC
Last updated: 09/11/2026, 15:18:59 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.