mal-2026-16114

{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "preinstall.js",
              "sha256": "bee47062733940943fd3a66654f0258135fd62911674304ccac11a43226b5f58",
              "tlsh": "ebe027f4118ca6683ccc01c4636b191ed4dfc705bcdec8c04a55d78587b15f1d6115f0"
            },
            {
              "path": "package.json",
              "sha256": "5aec9699d328dadcfbff66a3724ff4c7b1b2db6d0e48d7be6f44fe4415f5c298",
              "tlsh": "4bd0a7388a34a87369d403a15d63898676b50d5f00987c04179b205843b9b3f86bf60e"
            }
          ],
          "package_integrity": [
            {
              "filename": "etoro-auth-999.0.0.tgz",
              "hashes": {
                "sha1": "03ad51441a2888aa7af46f51af36e94519edaefd",
                "sha512_sri": "sha512-SzyI9Fr1Ewo0E4p5WPkqQGiKcxsXLhkWTDJFLaxgt70krdof3C67jRErSCDqB84o/AgYITtz7Ee3DNkxCc37xA=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "etoro-auth"
      },
      "versions": [
        "999.0.0",
        "99.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://github.com/ossf/package-analysis",
        "https://openssf.slack.com/channels/package_analysis"
      ],
      "name": "OpenSSF: Package Analysis",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-019907",
        "import_time": "2026-09-10T05:18:05.806423684Z",
        "modified_time": "2026-09-10T04:43:38Z",
        "sha256": "fa74d0f23335d017c81fa03793e5edc3571052772ad743ecbd476ce4049d8a0b",
        "source": "amazon-inspector",
        "versions": [
          "999.0.0"
        ]
      },
      {
        "id": "IN-MAL-2026-020002",
        "import_time": "2026-09-11T18:21:32.211728975Z",
        "modified_time": "2026-09-11T17:56:07Z",
        "sha256": "385c1c361c59557137d095062a9f767a4c0cd0a1ef78b0b26e4654147e137e3c",
        "source": "amazon-inspector",
        "versions": [
          "99.0.0"
        ]
      },
      {
        "import_time": "2026-09-14T03:24:14.60810945Z",
        "modified_time": "2026-09-11T14:11:12Z",
        "sha256": "de55cf40132e522735bf8195a1616bb5c19e2ca8a316ef7b807465d1b65208b9",
        "source": "ossf-package-analysis",
        "versions": [
          "99.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (385c1c361c59557137d095062a9f767a4c0cd0a1ef78b0b26e4654147e137e3c)\nThe package's preinstall.js runs automatically on `npm install` and collects host identifiers (os.hostname(), os.userInfo().username, process.cwd(), process.platform), sending them via HTTP GET to a hardcoded bare-IP endpoint at http://209.126.81.147/etoro-nuget-verify1f8eaa57a875/npm/v2/<hostname>/<user>/<platform>/<cwd>. It then executes `whoami`, `id`, and `hostname -f` (or `whoami /all` on Windows) via child_process and POSTs the command output to the same endpoint. The package's main entry (index.js) is empty; the only shipped behavior is the reconnaissance beacon. The package name and version (etoro-auth@99.0.0) together with the URL path segment `etoro-nuget-verify` fit a dependency-confusion probe targeting eToro's internal namespace, with the high version number used to win resolution against an internal package of the same name.\n\n## Source: ossf-package-analysis (de55cf40132e522735bf8195a1616bb5c19e2ca8a316ef7b807465d1b65208b9)\nThe OpenSSF Package Analysis project identified 'etoro-auth' @ 99.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n",
  "id": "MAL-2026-16114",
  "modified": "2026-09-14T03:26:03.917954217Z",
  "published": "2026-09-10T04:43:38Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/etoro-auth/v/999.0.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/etoro-auth/v/99.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in etoro-auth (npm)"
}