etoro-auth@999.0.0

Summary

The package ships an empty library stub (index.js exports {}) alongside a preinstall lifecycle script that runs automatically on npm install. preinstall.js performs an unauthenticated plaintext HTTP GET to the hardcoded bare-IP endpoint http://209.126.81.147/etoro-depconf-poce346552f776f/npm/<hostname>/<username>/<cwd>, transmitting the installer's OS hostname, OS username, and current working directory as URL path segments. The package name resembles an eToro internal authentication client and is published at version 999.0.0 with no functional code, a shape consistent with dependency-confusion reconnaissance intended to resolve inside eToro build systems and report back which internal hosts pulled the public lure.

Source: amazon-inspector (fa74d0f23335d017c81fa03793e5edc3571052772ad743ecbd476ce4049d8a0b)