GCVE-110-OSM-2026-11929

The package ships an empty library stub (index.js exports `{}`) alongside a preinstall lifecycle script that runs automatically on `npm install`. preinstall.js performs an unauthenticated plaintext HTTP GET to the hardcoded bare-IP endpoint http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<hostname>/<username>/<cwd>, transmitting the installer's OS hostname, OS username, and current working directory as URL path segments. The package name resembles an eToro internal authentication client and is published at version 999.0.0 with no functional code, a shape consistent with dependency-confusion reconnaissance intended to resolve inside eToro build systems and report back which internal hosts pulled the public lure. ENTRY preinstall.js (install-hook: node preinstall.js || true) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in preinstall.js: "encodeURIComponent(os.hostname())}/${encodeURIComponent(os.userInfo().username)}..." - Network Request in preinstall.js: "https.get(" - System Information Collection in preinstall.js: "os.userInfo()" - Suspicious Domain in preinstall.js: "http://209.126.81.147" PAYLOAD FILES preinstall.js