etoro-authnpm
Advisory published Updated
etoro-auth is a confirmed malicious npm package (MAL-2026-16114) that opens a backdoor for remote access (malicious versions 99.0.0, 999.0.0). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in etoro-auth (npm)
What this malware does
The package's preinstall.js runs automatically on npm install and collects host identifiers (os.hostname(), os.userInfo().username, process.cwd(), process.platform), sending them via HTTP GET to a hardcoded bare-IP endpoint at http://209.126.81.147/etoro-nuget-verify1f8eaa57a875/npm/v2/<hostname>/<user>/<platform>/<cwd>. It then executes whoami, id, and hostname -f (or whoami /all on Windows) via child_process and POSTs the command output to the same endpoint. The package's main entry (index.js) is empty; the only shipped behavior is the reconnaissance beacon. The package name and version ([email protected]) together with the URL path segment etoro-nuget-verify fit a dependency-confusion probe targeting eToro's internal namespace, with the high version number used to win resolution against an internal package of the same name.
The OpenSSF Package Analysis project identified 'etoro-auth' @ 99.0.0 (npm) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Backdoor / remote accessFind it
Search your lockfiles and build artifacts for etoro-auth (2 malicious versions).
If you installed it — respond
etoro-auth establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If etoro-auth was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
- OpenSSF: Package Analysis · finder
Detect & block this
O3 blocks etoro-auth-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.