MAL-2026-16111 Malicious code in etoro-aggregator (npm)

The package's preinstall.js lifecycle script executes automatically on npm install and performs reconnaissance on the installer host. It collects hostname, username, current working directory, platform, and the output of OS commands including whoami /all, ipconfig /all / ifconfig, tasklist / ps aux, directory listings of /, C:\, and the user's home, and a dump of environment variables. The collected data is transmitted via HTTP GET and POST to the hardcoded bare IP endpoint http://209.126.81.147/etoro-nuget-verify1f8eaa57a875/v4/.... The package's declared main is an empty stub and its description ("Internal service client library") combined with the implausibly high version number 99.0.2 is consistent with a dependency-confusion attack targeting an internal etoro-aggregator name. The manifest plus the preinstall script constitute the entire payload; installing the package leaks installer host identity, network configuration, filesystem structure, and environment variables (which routinely contain credentials and tokens) to an attacker-controlled endpoint.