MAL-2026-16111

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/etoro-aggregator/MAL-2026-16111.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16111
Published
2026-09-10T04:44:38Z
Modified
2026-09-11T18:45:05Z
Summary
Malicious code in etoro-aggregator (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d7d5f0fb8c06c23afad28686a3d3d689dfc5a3786c73bff2c569fd8b55f2b4ad)

The package's preinstall.js lifecycle script executes automatically on npm install and performs reconnaissance on the installer host. It collects hostname, username, current working directory, platform, and the output of OS commands including whoami /all, ipconfig /all / ifconfig, tasklist / ps aux, directory listings of /, C:\, and the user's home, and a dump of environment variables. The collected data is transmitted via HTTP GET and POST to the hardcoded bare IP endpoint http://209.126.81.147/etoro-nuget-verify1f8eaa57a875/v4/.... The package's declared main is an empty stub and its description ("Internal service client library") combined with the implausibly high version number 99.0.2 is consistent with a dependency-confusion attack targeting an internal etoro-aggregator name. The manifest plus the preinstall script constitute the entire payload; installing the package leaks installer host identity, network configuration, filesystem structure, and environment variables (which routinely contain credentials and tokens) to an attacker-controlled endpoint.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019913",
            "import_time": "2026-09-10T05:18:06.154710325Z",
            "modified_time": "2026-09-10T04:44:38Z",
            "sha256": "6e7805793fe0fa0f03f018a31574ec577e87f249231d9ada54cdf052395a65d1",
            "source": "amazon-inspector",
            "versions": [
                "999.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-019995",
            "import_time": "2026-09-11T18:21:31.876442289Z",
            "modified_time": "2026-09-11T17:55:12Z",
            "sha256": "d7d5f0fb8c06c23afad28686a3d3d689dfc5a3786c73bff2c569fd8b55f2b4ad",
            "source": "amazon-inspector",
            "versions": [
                "99.0.2"
            ]
        },
        {
            "id": "IN-MAL-2026-020000",
            "import_time": "2026-09-11T18:21:32.129840182Z",
            "modified_time": "2026-09-11T17:55:51Z",
            "sha256": "fed6b767c0c79e7ff5fde78cb9a70e9a5d734eb7dbd4b0c6587d2401b3b99394",
            "source": "amazon-inspector",
            "versions": [
                "99.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / etoro-aggregator

Package

Name
etoro-aggregator
View open source insights on deps.dev
Purl
pkg:npm/etoro-aggregator

Affected ranges

Affected versions

99.*
99.0.0
99.0.2
999.*
999.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "preinstall.js",
            "sha256": "bee47062733940943fd3a66654f0258135fd62911674304ccac11a43226b5f58",
            "tlsh": "ebe027f4118ca6683ccc01c4636b191ed4dfc705bcdec8c04a55d78587b15f1d6115f0"
        }
    ],
    "package_integrity": [
        {
            "filename": "etoro-aggregator-999.0.0.tgz",
            "hashes": {
                "sha1": "672fb109116e914c286f98c26419993208a582d7",
                "sha512_sri": "sha512-FJgBrtluocgzTKx5Y5QuyJfnttviV20BaXEMYtykHkgdLI+BCScq6JVA2EF2N0NIAZxxieTSrsGabKdwbAXnGQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/etoro-aggregator/MAL-2026-16111.json"