The alelo-client package on npm, specifically versions 99.0.0 and 99.0.2, is a malicious dependency-confusion package impersonating an internal namespace. Its preinstall.js script collects hostname, username, platform, current working directory, and the full environment variables, sending this information via HTTPS POST to a bare IP address with TLS certificate verification disabled. The postinstall script reads sensitive files such as .env, .npmrc, package.json, and parent-directory .env files, executes system commands like whoami or id, and sends all collected data to the same attacker-controlled endpoint. The .npmrc file read exposes the installer's npm authentication token, and the .env files may contain application secrets, resulting in significant credential and secret leakage. Additionally, the package includes a login.ps1 script referencing an external npm account, indicating attacker control.

Installation of alelo-client versions 99.0.0 or 99.0.2 results in exfiltration of sensitive environment information, authentication tokens, and application secrets to an attacker-controlled server. This compromises the confidentiality of the installer's machine environment and credentials, potentially enabling further unauthorized access or compromise of systems and services relying on those secrets.

No official patch or remediation is currently documented. Users should avoid installing alelo-client versions 99.0.0 and 99.0.2. Review and revoke any npm authentication tokens that may have been exposed. Inspect and rotate any application secrets that may have been compromised. Monitor for any suspicious activity related to credentials or systems that used these tokens or secrets. Check the vendor or npm advisories for updates or official guidance.