The npm package 'etoro-builders' version 999.0.0 contains malicious code in its preinstall script that collects the installer's OS hostname, username, and current working directory. This information is encoded into a URL path and sent via an HTTP GET request to a hardcoded external IP address over unencrypted HTTP. The package appears to be a dependency confusion payload designed to masquerade as an internal package and report successful installations to an external operator.