The alelo-services package versions 99.0.0 and 99.0.2 include preinstall and postinstall scripts that harvest extensive environment and credential data from the installation environment. The preinstall script collects hostname, username, platform, current working directory, and the entire process environment, sending it to https://209.99.185.109/preinstall with TLS verification disabled. The postinstall script reads multiple environment and configuration files (.env, .npmrc, package.json) including npm authentication tokens and cloud/CI credentials, executes system commands (whoami/id), and sends all collected data to https://209.99.185.109/postinstall. This behavior indicates a malicious package designed to exfiltrate sensitive information, likely as part of a dependency confusion attack.

Sensitive information including npm authentication tokens, environment variables, cloud and CI credentials, and system user details can be exfiltrated to an attacker-controlled server. This can lead to unauthorized access to private repositories, cloud environments, and continuous integration systems, potentially resulting in further compromise of development and deployment pipelines.

No official patch or remediation is currently documented. Users should immediately avoid installing or using alelo-services versions 99.0.0 and 99.0.2. Audit existing environments for presence of this package and remove it if found. Monitor for suspicious network connections to the IP address 209.99.185.109. Check vendor advisories or trusted security sources for updates or fixes. Due to the lack of an official fix, consider using alternative trusted packages and implement strict supply chain security controls.