The npm package etoro-client@999.0.0 contains malicious code in its preinstall lifecycle script that sends the installer's hostname, OS username, and current working directory to a hardcoded IP address over plain HTTP. This behavior indicates a dependency-confusion attack, where a high-version public package impersonates an internal package to capture sensitive environment information during installation.