MAL-2026-16114

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/etoro-auth/MAL-2026-16114.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16114
Published
2026-09-10T04:43:38Z
Modified
2026-09-14T03:30:06Z
Summary
Malicious code in etoro-auth (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (385c1c361c59557137d095062a9f767a4c0cd0a1ef78b0b26e4654147e137e3c)

The package's preinstall.js runs automatically on npm install and collects host identifiers (os.hostname(), os.userInfo().username, process.cwd(), process.platform), sending them via HTTP GET to a hardcoded bare-IP endpoint at http://209.126.81.147/etoro-nuget-verify1f8eaa57a875/npm/v2////. It then executes whoami, id, and hostname -f (or whoami /all on Windows) via child_process and POSTs the command output to the same endpoint. The package's main entry (index.js) is empty; the only shipped behavior is the reconnaissance beacon. The package name and version (etoro-auth@99.0.0) together with the URL path segment etoro-nuget-verify fit a dependency-confusion probe targeting eToro's internal namespace, with the high version number used to win resolution against an internal package of the same name.

Source: ossf-package-analysis (de55cf40132e522735bf8195a1616bb5c19e2ca8a316ef7b807465d1b65208b9)

The OpenSSF Package Analysis project identified 'etoro-auth' @ 99.0.0 (npm) as malicious.

It is considered malicious because:

  • The package executes one or more commands associated with malicious behavior.
Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-019907",
            "import_time":  "2026-09-10T05:18:05.806423684Z",
            "modified_time":  "2026-09-10T04:43:38Z",
            "sha256":  "fa74d0f23335d017c81fa03793e5edc3571052772ad743ecbd476ce4049d8a0b",
            "source":  "amazon-inspector",
            "versions":  [
                "999.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-020002",
            "import_time":  "2026-09-11T18:21:32.211728975Z",
            "modified_time":  "2026-09-11T17:56:07Z",
            "sha256":  "385c1c361c59557137d095062a9f767a4c0cd0a1ef78b0b26e4654147e137e3c",
            "source":  "amazon-inspector",
            "versions":  [
                "99.0.0"
            ]
        },
        {
            "import_time":  "2026-09-14T03:24:14.60810945Z",
            "modified_time":  "2026-09-11T14:11:12Z",
            "sha256":  "de55cf40132e522735bf8195a1616bb5c19e2ca8a316ef7b807465d1b65208b9",
            "source":  "ossf-package-analysis",
            "versions":  [
                "99.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / etoro-auth

Package

Name
etoro-auth
View open source insights on deps.dev
Purl
pkg:npm/etoro-auth

Affected ranges

Affected versions

99.*
99.0.0
999.*
999.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "preinstall.js",
            "sha256":  "bee47062733940943fd3a66654f0258135fd62911674304ccac11a43226b5f58",
            "tlsh":  "ebe027f4118ca6683ccc01c4636b191ed4dfc705bcdec8c04a55d78587b15f1d6115f0"
        },
        {
            "path":  "package.json",
            "sha256":  "5aec9699d328dadcfbff66a3724ff4c7b1b2db6d0e48d7be6f44fe4415f5c298",
            "tlsh":  "4bd0a7388a34a87369d403a15d63898676b50d5f00987c04179b205843b9b3f86bf60e"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "etoro-auth-999.0.0.tgz",
            "hashes":  {
                "sha1":  "03ad51441a2888aa7af46f51af36e94519edaefd",
                "sha512_sri":  "sha512-SzyI9Fr1Ewo0E4p5WPkqQGiKcxsXLhkWTDJFLaxgt70krdof3C67jRErSCDqB84o/AgYITtz7Ee3DNkxCc37xA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/etoro-auth/MAL-2026-16114.json"