etoro-analytics@99.0.0

Analysis

The preinstall hook (node preinstall.js) collects the hostname, username, working directory, and platform of the installing machine and sends them to 209[.]126[.]81[.]147 at /etoro-nuget-verify1f8eaa57a875/npm/v2/{host}/{user}/{platform}/{cwd}. It then runs `whoami` (or `whoami /all` on Windows) plus `id` and `hostname -f`, and POSTs the output to the same host at /etoro-nuget-verify1f8eaa57a875/npm/v2/whoami/{host}. The package exfiltrates the installer's identity and environment to a hardcoded remote IP on install.