MalwarePublished 14 Aug 2026Updated 24 Sep 2026

alelo-auth (npm) · Malicious Code

Affects alelo-authSource GCVE Database

Malicious package : remove alelo-auth and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:16 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-14021

What to do

Remove alelo-auth from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmalelo-auth	Affected =99.0.0 =99.0.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The alelo-auth npm package versions 99.0.0 and 99.0.2 contain malicious code that exfiltrates sensitive environment and credential data. Its preinstall script collects system information and environment variables, sending them to an untrusted IP address with TLS verification disabled. The postinstall script further reads local credential files and executes system commands to gather user identity data, which it also transmits insecurely to the same remote endpoint. This behavior indicates a credential-stealing backdoor likely intended for dependency confusion attacks targeting private namespaces.

Impact

Sensitive credential data including npm authentication tokens and cloud/API credentials can be exfiltrated to an attacker-controlled server. This can lead to unauthorized access to private repositories, cloud services, and other resources. The use of disabled TLS verification increases the risk of interception or manipulation during data transmission. The malicious package poses a significant risk to environments that install it, potentially compromising developer and deployment credentials.

Defensive guidance

Avoid using the alelo-auth package versions 99.0.0 and 99.0.2. Remove these versions from your dependency tree immediately. Audit your environment for leaked credentials and rotate any potentially compromised tokens or secrets. Monitor for any unexpected network connections to suspicious IP addresses such as 209.99.185.109. Consider implementing strict dependency controls to prevent dependency confusion attacks.

Summary

The alelo-auth npm package versions 99.0.0 and 99.0.2 include malicious preinstall and postinstall scripts. The preinstall.js script collects hostname, username, platform, current working directory, and the full process environment, then sends this data via HTTPS POST to an IP address (https://209.99.185.109/preinstall) with TLS verification disabled (rejectUnauthorized:false). The postinstall script (index.js) reads local credential files such as .env, .npmrc, and package.json, captures process environment variables, executes system commands (whoami/id), and sends all aggregated data to https://209.99.185.109/postinstall, also with TLS verification disabled. The targeted data includes npm authentication tokens and cloud/API credentials, representing a high-value credential theft. The package metadata suggests it is a dependency confusion lure targeting private alelo-* namespaces.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Aug 2026, 16:52 UTC

Technical details

References

Community reviews