The alelo-utils npm package at version 99.0.0 includes malicious installation scripts that perform data exfiltration. The preinstall.js script collects hostname, username, platform, current working directory, and the full process environment, then posts this data to a suspicious IPv4 address (https://209.99.185.109/preinstall) with TLS verification disabled (rejectUnauthorized:false). The postinstall/index.js script reads sensitive configuration files (.env, .npmrc, package.json, and parent directory .env files), executes system commands (whoami/id), and posts the collected data to https://209.99.185.109/postinstall over the same insecure channel. The package metadata suggests dependency confusion tactics, with a version number 99.0.0 and a bundled login.ps1 referencing an npm publish workflow under a personal email account ([email protected]) that does not match the claimed 'Alelo Dev Team' author. This install-time exfiltration directly compromises installer credentials and secrets.

Sensitive environment variables, configuration files, and system information are exfiltrated to an untrusted external server during package installation. This includes npm authentication tokens and cloud/API credentials typically stored in .npmrc and .env files. The compromised credentials can lead to unauthorized access to private repositories, cloud services, or other resources. The use of TLS with disabled verification increases the risk of interception or manipulation of the data in transit.

No official patch or remediation is currently documented. Users should avoid installing alelo-utils version 99.0.0 from untrusted sources. Review and revoke any potentially exposed npm authentication tokens and cloud/API credentials if this package was installed. Monitor for suspicious activity related to compromised credentials. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.