MalwarePublished 14 Aug 2026Updated 24 Sep 2026

alelo-services (npm) · Malicious Code

Affects alelo-servicesSource GCVE Database

Malicious package : remove alelo-services and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:16 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-14027

What to do

Remove alelo-services from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmalelo-services	Affected =99.0.2 =99.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The alelo-services npm package version 99.0.0 and 99.0.2 contains malicious code that executes during both preinstall and postinstall lifecycle scripts. These scripts collect sensitive environment data including hostnames, usernames, environment variables, npm authentication tokens, and cloud/CI credentials, then send this information to a hardcoded IP address with disabled TLS verification. The package appears to be a dependency confusion attack targeting private scope names with generic metadata to lure victims.

Impact

Sensitive information including npm authentication tokens, environment variables, cloud and CI credentials, and system user details can be exfiltrated to an attacker-controlled server. This can lead to unauthorized access to private repositories, cloud environments, and continuous integration systems, potentially resulting in further compromise of development and deployment pipelines.

Defensive guidance

Users should immediately avoid installing or using alelo-services versions 99.0.0 and 99.0.2. Audit existing environments for presence of this package and remove it if found. Monitor for suspicious network connections to the IP address 209.99.185.109. Check vendor advisories or trusted security sources for updates or fixes. Due to the lack of an official fix, consider using alternative trusted packages and implement strict supply chain security controls.

Summary

The alelo-services package versions 99.0.0 and 99.0.2 include preinstall and postinstall scripts that harvest extensive environment and credential data from the installation environment. The preinstall script collects hostname, username, platform, current working directory, and the entire process environment, sending it to https://209.99.185.109/preinstall with TLS verification disabled. The postinstall script reads multiple environment and configuration files (.env, .npmrc, package.json) including npm authentication tokens and cloud/CI credentials, executes system commands (whoami/id), and sends all collected data to https://209.99.185.109/postinstall. This behavior indicates a malicious package designed to exfiltrate sensitive information, likely as part of a dependency confusion attack.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Aug 2026, 16:51 UTC

Technical details

References

Community reviews