The npm package etoro-api version 999.0.0 contains malicious code in its preinstall lifecycle script. This script automatically executes during npm install and sends an HTTP GET request to a hardcoded IP address unrelated to legitimate eToro infrastructure. The request includes sensitive environment details such as the installer's hostname, OS username, and current working directory. The package uses a high version number and a name mimicking an internal private package to exploit dependency confusion.