etoro-billing@999.0.0

Analysis

etoro-billing@999.0.0 is a dependency-confusion stub impersonating eToro's billing service. Its preinstall hook runs node preinstall.js, which on install makes an HTTP GET to hxxp://209[.]126[.]81[.]147/etoro-depconf-poce346552f776f/npm/{hostname}/{username}/{cwd}, exfiltrating the machine's hostname, OS username, and current working directory to a remote IP. The hook swallows errors (|| true) so the beacon runs silently during install.