The npm package 'etoro-core' version 999.0.0 contains malicious code in its preinstall lifecycle script. This script performs an HTTP GET request to a hardcoded attacker-controlled IP address, transmitting the host's identity information in plaintext during installation. This behavior is consistent with a dependency confusion attack targeting an internal package name.