MAL-2026-16118

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/etoro-charts/MAL-2026-16118.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16118
Published
2026-09-10T04:43:46Z
Modified
2026-09-11T18:45:05Z
Summary
Malicious code in etoro-charts (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e44aff5a1a0b68ff9c9b3456693ef1b8266dce7001dd8b6ff56bed428bbc7c5a)

On npm install, preinstall.js runs automatically and sends the installer's hostname, username, platform, and current working directory via HTTP GET to http://209.126.81.147/etoro-nuget-verify1f8eaa57a875/npm/v2////, then executes whoami; id; hostname -f (or whoami /all on Windows) via child_process and POSTs the command output to the same hardcoded bare-IP endpoint over plain HTTP. The package.json advertises the package as an Internal service client library at version 99.0.0 with no real functional code beyond the preinstall hook, and the beacon path segment etoro-nuget-verify... targets an internal eToro namespace, matching the dependency-confusion recon pattern.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-019908",
            "import_time":  "2026-09-10T05:18:05.886169956Z",
            "modified_time":  "2026-09-10T04:43:46Z",
            "sha256":  "484ce8002025d68c4a60feca03aec63425a66b85e2465415a4fc5a29e3a61f43",
            "source":  "amazon-inspector",
            "versions":  [
                "999.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-019993",
            "import_time":  "2026-09-11T18:21:31.809417405Z",
            "modified_time":  "2026-09-11T17:54:56Z",
            "sha256":  "e44aff5a1a0b68ff9c9b3456693ef1b8266dce7001dd8b6ff56bed428bbc7c5a",
            "source":  "amazon-inspector",
            "versions":  [
                "99.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / etoro-charts

Package

Name
etoro-charts
View open source insights on deps.dev
Purl
pkg:npm/etoro-charts

Affected ranges

Affected versions

99.*
99.0.0
999.*
999.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "preinstall.js",
            "sha256":  "bee47062733940943fd3a66654f0258135fd62911674304ccac11a43226b5f58",
            "tlsh":  "ebe027f4118ca6683ccc01c4636b191ed4dfc705bcdec8c04a55d78587b15f1d6115f0"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "etoro-charts-999.0.0.tgz",
            "hashes":  {
                "sha1":  "e2400e0160b5ce82b7c52b98c393b95aa7e367e3",
                "sha512_sri":  "sha512-xS1cXLPjcDV1gsFkKAGsloWDIXpuavzXOnjQalQPq6JIwwkkmmA3FnVvoDMPKh4lBOIGCIPL2bIlKIoBGGjtJQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/etoro-charts/MAL-2026-16118.json"