MalwarePublished 14 Aug 2026Updated 24 Sep 2026

alelo-sdk (npm) · Malicious Code

Affects alelo-sdkSource GCVE Database

Malicious package : remove alelo-sdk and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:16 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-14026

What to do

Remove alelo-sdk from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmalelo-sdk	Affected =99.0.0 =99.0.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The alelo-sdk npm package versions 99.0.0 and 99.0.2 contain malicious lifecycle scripts that exfiltrate sensitive environment and configuration data to a hardcoded IP address. The preinstall script collects system and environment details and sends them to an external endpoint without TLS verification. The postinstall script further reads sensitive files such as .env and .npmrc, executes system commands, and sends this data to the same endpoint, risking exposure of credentials and tokens.

Impact

Any environment where alelo-sdk versions 99.0.0 or 99.0.2 are installed is at risk of having sensitive environment variables, configuration files, and credentials exfiltrated to an attacker-controlled server. This includes developer workstations and continuous integration systems, potentially compromising npm tokens, cloud credentials, and other secrets. The lack of TLS certificate verification increases the risk of interception or manipulation of the exfiltrated data.

Defensive guidance

Avoid installing or using alelo-sdk versions 99.0.0 and 99.0.2. Remove these versions from any environment where they are present. Monitor for suspicious npm packages mimicking internal scopes with inflated version numbers to prevent dependency confusion attacks.

Summary

The alelo-sdk package (versions 99.0.0 and 99.0.2) includes malicious preinstall and postinstall lifecycle scripts that harvest sensitive information from the host environment. The preinstall.js script collects hostname, username, platform, current working directory, and the full process environment variables, sending this data as JSON to https://209.99.185.109/preinstall with TLS verification disabled. The postinstall script reads additional sensitive files (.env, .npmrc, parent-directory .env), executes commands like whoami or id, and posts the collected data to https://209.99.185.109/postinstall. This behavior exposes secrets such as npm publish tokens and cloud/API credentials to an attacker-controlled server. The package is designed to appear as an internal utility with an inflated version number to facilitate dependency confusion attacks.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Aug 2026, 16:51 UTC

Technical details

References

Community reviews