The alelo-auth npm package versions 99.0.0 and 99.0.2 include malicious preinstall and postinstall scripts. The preinstall.js script collects hostname, username, platform, current working directory, and the full process environment, then sends this data via HTTPS POST to an IP address (https://209.99.185.109/preinstall) with TLS verification disabled (rejectUnauthorized:false). The postinstall script (index.js) reads local credential files such as .env, .npmrc, and package.json, captures process environment variables, executes system commands (whoami/id), and sends all aggregated data to https://209.99.185.109/postinstall, also with TLS verification disabled. The targeted data includes npm authentication tokens and cloud/API credentials, representing a high-value credential theft. The package metadata suggests it is a dependency confusion lure targeting private alelo-* namespaces.

Sensitive credential data including npm authentication tokens and cloud/API credentials can be exfiltrated to an attacker-controlled server. This can lead to unauthorized access to private repositories, cloud services, and other resources. The use of disabled TLS verification increases the risk of interception or manipulation during data transmission. The malicious package poses a significant risk to environments that install it, potentially compromising developer and deployment credentials.

Avoid using the alelo-auth package versions 99.0.0 and 99.0.2. Remove these versions from your dependency tree immediately. Since no official patch or remediation is indicated, do not install or update to these versions. Audit your environment for leaked credentials and rotate any potentially compromised tokens or secrets. Monitor for any unexpected network connections to suspicious IP addresses such as 209.99.185.109. Consider implementing strict dependency controls to prevent dependency confusion attacks.