If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (385c1c361c59557137d095062a9f767a4c0cd0a1ef78b0b26e4654147e137e3c)
The package's preinstall.js runs automatically on `npm install` and collects host identifiers (os.hostname(), os.userInfo().username, process.cwd(), process.platform), sending them via HTTP GET to a hardcoded bare-IP endpoint at http://209.126.81.147/etoro-nuget-verify1f8eaa57a875/npm/v2/<hostname>/<user>/<platform>/<cwd>. It then executes `whoami`, `id`, and `hostname -f` (or `whoami /all` on Windows) via child_process and POSTs the command output to the same endpoint. The package's main entry (index.js) is empty; the only shipped behavior is the reconnaissance beacon. The package name and version (etoro-auth@99.0.0) together with the URL path segment `etoro-nuget-verify` fit a dependency-confusion probe targeting eToro's internal namespace, with the high version number used to win resolution against an internal package of the same name.
Source: ossf-package-analysis (de55cf40132e522735bf8195a1616bb5c19e2ca8a316ef7b807465d1b65208b9)
The OpenSSF Package Analysis project identified 'etoro-auth' @ 99.0.0 (npm) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.