The alelo-payment npm package (versions 99.0.0 and 99.0.2) includes malicious preinstall and postinstall scripts that collect and exfiltrate sensitive data from the host environment. The preinstall.js script gathers hostname, username, platform, current working directory, and the full process environment variables, then sends this information via HTTPS POST to a hardcoded IP address (209.99.185.109) with TLS verification disabled (rejectUnauthorized:false). The postinstall script reads sensitive configuration files (.env, .npmrc, package.json) and executes commands like whoami/id to gather user identity information, then sends this combined data to the same IP address. The .npmrc file may contain npm authentication tokens, and .env files often hold CI/CD secrets and cloud credentials, making this exfiltration highly sensitive. A bundled PowerShell artifact references publishing under the npm account [email protected]. The package versioning and naming suggest it is a malicious typosquat or dependency confusion lure without legitimate functionality.

This malicious package can lead to the exposure of sensitive environment variables, authentication tokens, CI/CD secrets, and cloud credentials from the victim's environment. The attacker can use this stolen information to compromise systems, escalate privileges, or access cloud resources. The disabled TLS verification increases the risk of interception or manipulation during data exfiltration. Since the package has no legitimate functionality, its presence indicates a supply chain compromise or targeted attack vector.

No official patch or remediation is available as this is a malicious package rather than a vulnerability in legitimate software. Users should avoid installing alelo-payment versions 99.0.0 and 99.0.2. Remove any installations of this package immediately and revoke any potentially exposed credentials or tokens. Review npm dependencies for typosquatting or dependency confusion risks. Monitor for suspicious network activity to the IP address 209.99.185.109 and block it if possible. Employ strict controls on package sources and use package integrity verification mechanisms.