If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (ab6228f994962694d4434f53d20d6a5a1b877b39a3498236327da9d0385284d9)
The preinstall lifecycle script in etoro-api@999.0.0 (preinstall.js) auto-executes on npm install and performs an HTTP GET to a hardcoded bare-IP endpoint at http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<host>/<user>/<cwd>, embedding the installer's hostname (os.hostname()), OS username (os.userInfo().username), and current working directory (process.cwd()) as URL path components. The destination is a plain-HTTP bare-IP host unrelated to any legitimate eToro publishing infrastructure. The package name combined with the implausibly high version number (999.0.0) is the canonical dependency-confusion shape used to force resolution over an internal private package of the same name.