etoro-charts@99.0.0
Malicious code in etoro-charts (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
The preinstall hook (node preinstall.js) collects the hostname, username, working directory, and platform of the installing machine and sends them to 209[.]126[.]81[.]147 at /etoro-nuget-verify1f8eaa57a875/npm/v2/{host}/{user}/{platform}/{cwd}. It then runs `whoami` (or `whoami /all` on Windows) plus `id` and `hostname -f`, and POSTs the output to the same host at /etoro-nuget-verify1f8eaa57a875/npm/v2/whoami/{host}. The package exfiltrates the installer's identity and environment to a hardcoded remote IP on install.
- analyzed by
- Leitwacht
- first seen
- Sep 11, 2026, 01:39 PM
- analyzed
- Sep 11, 2026, 07:25 PM
Related advisories
- etoro-charts@999.0.0 same package
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.