The etoro-client package version 999.0.0 on npm includes a preinstall script that unconditionally transmits sensitive environment details—specifically the installer's hostname, OS username, and current working directory—to a hardcoded bare-IP endpoint via an unencrypted HTTP request. The unusually high version number and the 'depconf' path token suggest this is a dependency-confusion attack designed to trick misconfigured package resolvers into downloading this malicious public package instead of the intended private internal package. The preinstall beacon serves to confirm successful compromise and gather identifying information about the target environment.

This malicious package leaks sensitive environment information during installation, potentially exposing hostnames, user identities, and directory structures to an attacker-controlled server. While no direct code execution or system compromise is described, the information disclosure can aid attackers in further targeted attacks or reconnaissance.

No official patch or remediation is currently documented. Users should avoid installing [email protected] and verify package sources to prevent dependency-confusion attacks. Organizations should audit their package resolution configurations to ensure private packages are not overridden by public packages with higher versions. Monitor for and remove any installations of this malicious package.