MAL-2026-16117

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/etoro-cashout/MAL-2026-16117.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16117
Published
2026-09-10T04:45:58Z
Modified
2026-09-10T05:30:11Z
Summary
Malicious code in etoro-cashout (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a35bbd75e3cc742fd88d59bcbb64858df0474505b5d6f93f10e8c727c718e129)

The package's preinstall lifecycle script (preinstall.js) runs automatically on npm install and issues an HTTP GET to a hardcoded bare-IP endpoint at http://209.126.81.147/etoro-depconf-poce346552f776f/npm///, embedding os.hostname(), os.userInfo().username, and process.cwd() as URL path segments. The destination is not a first-party or registry host, uses plain HTTP, and the transmission is unconditional and undisclosed. The package name and implausibly high version number (999.0.0) combined with an 'eToro Infrastructure' author string are consistent with a dependency-confusion probe designed to identify internal build environments that resolve the public name in place of a private one.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019915",
            "import_time": "2026-09-10T05:18:06.257486475Z",
            "modified_time": "2026-09-10T04:45:58Z",
            "sha256": "a35bbd75e3cc742fd88d59bcbb64858df0474505b5d6f93f10e8c727c718e129",
            "source": "amazon-inspector",
            "versions": [
                "999.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / etoro-cashout

Package

Name
etoro-cashout
View open source insights on deps.dev
Purl
pkg:npm/etoro-cashout

Affected ranges

Affected versions

999.*
999.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "preinstall.js",
            "sha256": "bee47062733940943fd3a66654f0258135fd62911674304ccac11a43226b5f58",
            "tlsh": "ebe027f4118ca6683ccc01c4636b191ed4dfc705bcdec8c04a55d78587b15f1d6115f0"
        }
    ],
    "package_integrity": [
        {
            "filename": "etoro-cashout-999.0.0.tgz",
            "hashes": {
                "sha1": "6be0db8f77a1da1981745fd01e3519c5b6de0965",
                "sha512_sri": "sha512-+oObK225egLxDtxuG7nwvQMvj7+AiKoi7cMQ1rVzqXSNbFE2uQFDFClsPw6xPt/GpoVCnWUT3t/jwft9Nw80sA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/etoro-cashout/MAL-2026-16117.json"