The 'alelo-api' npm package versions 99.0.0 and 99.0.2 execute attacker-controlled code during installation via preinstall.js and index.js scripts. The preinstall script collects system information and environment variables and sends them to a hardcoded IP address with TLS verification disabled. The postinstall script reads sensitive secret files from the current and parent directories, executes system commands to gather user identity information, and exfiltrates this data to the same IP. The package includes artifacts suggesting it is a typosquatting or dependency confusion attack aimed at Alelo, leaking npm tokens and environment secrets to an attacker-controlled endpoint.

Any user running 'npm install alelo-api' for the affected versions risks leaking sensitive environment variables, npm authentication tokens, and secret files (.env, .npmrc, package.json) from their working directory and parent directories. This can lead to credential compromise and unauthorized access to systems or services relying on these secrets.

No official patch or remediation is currently documented. Users should avoid installing the 'alelo-api' package versions 99.0.0 and 99.0.2. Verify package authenticity before installation and monitor for typosquatting or dependency confusion attempts. Check vendor advisories or trusted sources for updates or official fixes.