etoro-charts@999.0.0

Analysis

The package impersonates the eToro charting library (name "etoro-charts", version 999.0.0) and runs a preinstall hook on install that silently sends an HTTP request to hxxp://209[.]126[.]81[.]147/etoro-depconf-poce346552f776f/npm/{hostname}/{username}/{cwd}, exfiltrating the installer's hostname, username, and working directory to a remote IP. The hook swallows errors with `|| true` so the beacon runs without alerting the installer.