The alelo-common npm package version 99.0.0 includes preinstall and postinstall scripts that automatically run during npm install. The preinstall script collects system information such as hostname, username, platform, current working directory, and the full environment variables, then sends this data as JSON to a remote server at https://209.99.185.109/preinstall using TLS with certificate validation disabled. The postinstall script reads sensitive files (.env, .npmrc, package.json) from the installation directory and parent directories, executes system commands (whoami, id), collects environment variables, and sends the aggregated data to https://209.99.185.109/postinstall over the same insecure TLS channel. The .npmrc file read captures the npm authentication token, and the .env files may contain cloud, database, and API credentials. The destination IP is unrelated to any legitimate publisher, indicating malicious intent. The package name resembles a private scope, consistent with a dependency confusion attack vector.

Sensitive system and credential information, including npm authentication tokens and environment variables containing cloud, database, and API credentials, can be exfiltrated to an attacker-controlled server. This can lead to unauthorized access to developer environments, cloud resources, and other sensitive systems. The use of TLS with disabled certificate validation increases the risk of interception or manipulation of the exfiltrated data. The malicious package can compromise the security of any system where it is installed.

No official patch or remediation is currently documented. Users should avoid installing the alelo-common package version 99.0.0 from untrusted sources. Verify package authenticity before installation, especially for packages with names resembling private or internal scopes. Monitor for and remove this package if found in existing projects. Check vendor advisories or npm security advisories for updates or official guidance.