The alelo-core npm package (versions 99.0.0, 99.0.1, 99.0.2) contains malicious preinstall and postinstall scripts. The preinstall.js script collects hostname, username, platform, current working directory, and the entire process environment variables, then sends this data to an external IP address via HTTPS without certificate verification. The postinstall script reads sensitive files such as .env, .npmrc (which may contain npm auth tokens), and package.json from the installer's directory tree, executes system commands 'whoami' and 'id', and sends the collected data to the same external IP. This results in exfiltration of credentials, tokens, and host identity information from the machine installing the package. The package name mimics an internal or branded package, consistent with a dependency confusion attack vector. The publisher identity is linked to an npm account [email protected] via a shipped login.ps1 script. No known exploits in the wild or vendor advisories are currently documented.

Installation of the affected alelo-core package versions leads to unauthorized exfiltration of sensitive environment data, including npm authentication tokens, application secrets, and host identity information, to an untrusted external server. This compromises the confidentiality of credentials and potentially allows attackers to impersonate the user or gain further access to systems relying on these secrets.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid installing the alelo-core package versions 99.0.0, 99.0.1, and 99.0.2 from untrusted sources. Verify package authenticity and source before installation. Consider scanning existing environments for presence of this package and remove it if found.