MalwarePublished 10 Sep 2026

etoro-core (npm) · Malicious Code

Affects etoro-coreSource GCVE Database

Malicious package : remove etoro-core and rotate any secrets on hosts that installed it.

Data as of 10 Sep 2026, 13:39 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-16120

What to do

Remove etoro-core from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmetoro-core	Affected =999.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'etoro-core' version 999.0.0 contains malicious code in its preinstall lifecycle script. This script performs an HTTP GET request to a hardcoded attacker-controlled IP address, transmitting the host's identity information in plaintext during installation. This behavior is consistent with a dependency confusion attack targeting an internal package name.

Impact

The malicious preinstall script leaks sensitive host environment information (hostname, username, working directory) to an attacker-controlled server over plaintext HTTP. This exposure can aid attackers in reconnaissance and further targeted attacks. There is no indication of additional payloads or code execution beyond data exfiltration. No known exploits in the wild have been reported.

Defensive guidance

Users should avoid installing the 'etoro-core' package at version 999.0.0 from untrusted sources. Verify package authenticity before installation and monitor for updates or advisories from the package maintainers or npm registry. Since this is a malicious package likely introduced via dependency confusion, organizations should implement supply chain security best practices such as package allowlisting and internal package namespace enforcement.

Summary

The 'etoro-core' npm package at version 999.0.0 includes a preinstall.js script that automatically executes during 'npm install'. This script sends an HTTP GET request to http://209.126.81.147/etoro-depconf-poce346552f776f/npm/ embedding the host's OS hostname, username, and current working directory in the URL path. This transmits sensitive installer host identity information over unencrypted HTTP to an attacker-controlled endpoint. The package name and inflated version number suggest it is a dependency confusion payload designed to impersonate an internal 'etoro-core' package.

References

npmjs.com/package/etoro-core/v/999.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Sep 2026, 13:39 UTC

Technical details

References

Community reviews