The alelo-sdk package (versions 99.0.0 and 99.0.2) includes malicious preinstall and postinstall lifecycle scripts that harvest sensitive information from the host environment. The preinstall.js script collects hostname, username, platform, current working directory, and the full process environment variables, sending this data as JSON to https://209.99.185.109/preinstall with TLS verification disabled. The postinstall script reads additional sensitive files (.env, .npmrc, parent-directory .env), executes commands like whoami or id, and posts the collected data to https://209.99.185.109/postinstall. This behavior exposes secrets such as npm publish tokens and cloud/API credentials to an attacker-controlled server. The package is designed to appear as an internal utility with an inflated version number to facilitate dependency confusion attacks.

Any environment where alelo-sdk versions 99.0.0 or 99.0.2 are installed is at risk of having sensitive environment variables, configuration files, and credentials exfiltrated to an attacker-controlled server. This includes developer workstations and continuous integration systems, potentially compromising npm tokens, cloud credentials, and other secrets. The lack of TLS certificate verification increases the risk of interception or manipulation of the exfiltrated data.

Avoid installing or using alelo-sdk versions 99.0.0 and 99.0.2. Remove these versions from any environment where they are present. Since no patch or official fix is indicated, rely on blocking network communications to the IP 209.99.185.109 and auditing environments for presence of this package and any exfiltrated data. Monitor for suspicious npm packages mimicking internal scopes with inflated version numbers to prevent dependency confusion attacks.