GCVE-110-OSM-2026-11935

The package's preinstall lifecycle script (preinstall.js) issues an HTTP GET to the hardcoded bare-IP endpoint http://209.126.81.147/etoro-depconf-poce346552f776f/npm/ with os.hostname(), os.userInfo().username, and process.cwd() embedded in the URL path. This runs automatically on `npm install` and transmits installer host identity over plaintext HTTP to an attacker-controlled destination. The package name and inflated 999.0.0 version are consistent with a dependency-confusion payload targeting an internal `etoro-core` name. ENTRY preinstall.js (install-hook: node preinstall.js || true) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in preinstall.js: "encodeURIComponent(os.hostname())}/${encodeURIComponent(os.userInfo().username)}..." - Network Request in preinstall.js: "https.get(" - System Information Collection in preinstall.js: "os.userInfo()" - Suspicious Domain in preinstall.js: "http://209.126.81.147" PAYLOAD FILES preinstall.js