The 'etoro-core' npm package at version 999.0.0 includes a preinstall.js script that automatically executes during 'npm install'. This script sends an HTTP GET request to http://209.126.81.147/etoro-depconf-poce346552f776f/npm/ embedding the host's OS hostname, username, and current working directory in the URL path. This transmits sensitive installer host identity information over unencrypted HTTP to an attacker-controlled endpoint. The package name and inflated version number suggest it is a dependency confusion payload designed to impersonate an internal 'etoro-core' package.

The malicious preinstall script leaks sensitive host environment information (hostname, username, working directory) to an attacker-controlled server over plaintext HTTP. This exposure can aid attackers in reconnaissance and further targeted attacks. There is no indication of additional payloads or code execution beyond data exfiltration. No known exploits in the wild have been reported.

No official patch or remediation is currently documented. Users should avoid installing the 'etoro-core' package at version 999.0.0 from untrusted sources. Verify package authenticity before installation and monitor for updates or advisories from the package maintainers or npm registry. Since this is a malicious package likely introduced via dependency confusion, organizations should implement supply chain security best practices such as package allowlisting and internal package namespace enforcement.