MAL-2026-16114

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/etoro-auth/MAL-2026-16114.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16114
Published
2026-09-10T04:43:38Z
Modified
2026-09-10T05:30:11Z
Summary
Malicious code in etoro-auth (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fa74d0f23335d017c81fa03793e5edc3571052772ad743ecbd476ce4049d8a0b)

The package ships an empty library stub (index.js exports {}) alongside a preinstall lifecycle script that runs automatically on npm install. preinstall.js performs an unauthenticated plaintext HTTP GET to the hardcoded bare-IP endpoint http://209.126.81.147/etoro-depconf-poce346552f776f/npm///, transmitting the installer's OS hostname, OS username, and current working directory as URL path segments. The package name resembles an eToro internal authentication client and is published at version 999.0.0 with no functional code, a shape consistent with dependency-confusion reconnaissance intended to resolve inside eToro build systems and report back which internal hosts pulled the public lure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019907",
            "import_time": "2026-09-10T05:18:05.806423684Z",
            "modified_time": "2026-09-10T04:43:38Z",
            "sha256": "fa74d0f23335d017c81fa03793e5edc3571052772ad743ecbd476ce4049d8a0b",
            "source": "amazon-inspector",
            "versions": [
                "999.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / etoro-auth

Package

Name
etoro-auth
View open source insights on deps.dev
Purl
pkg:npm/etoro-auth

Affected ranges

Affected versions

999.*
999.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "preinstall.js",
            "sha256": "bee47062733940943fd3a66654f0258135fd62911674304ccac11a43226b5f58",
            "tlsh": "ebe027f4118ca6683ccc01c4636b191ed4dfc705bcdec8c04a55d78587b15f1d6115f0"
        },
        {
            "path": "package.json",
            "sha256": "5aec9699d328dadcfbff66a3724ff4c7b1b2db6d0e48d7be6f44fe4415f5c298",
            "tlsh": "4bd0a7388a34a87369d403a15d63898676b50d5f00987c04179b205843b9b3f86bf60e"
        }
    ],
    "package_integrity": [
        {
            "filename": "etoro-auth-999.0.0.tgz",
            "hashes": {
                "sha1": "03ad51441a2888aa7af46f51af36e94519edaefd",
                "sha512_sri": "sha512-SzyI9Fr1Ewo0E4p5WPkqQGiKcxsXLhkWTDJFLaxgt70krdof3C67jRErSCDqB84o/AgYITtz7Ee3DNkxCc37xA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/etoro-auth/MAL-2026-16114.json"