The 'meualelo' npm package at version 99.0.0 includes a preinstall.js script that collects system information (hostname, username, platform, cwd, and full process environment) and sends this data via HTTPS POST to a hardcoded IP address with TLS verification disabled. The postinstall script reads sensitive configuration files (.env, .npmrc, package.json, and parent-directory .env), executes system commands (whoami/id), and exfiltrates all collected data to the same endpoint. The .npmrc file may contain npm authentication tokens, and .env files often hold cloud, database, and CI credentials, making this exfiltration highly sensitive. The package falsely claims to be authored by 'Alelo Dev Team' and includes a login PowerShell script referencing a personal proton.me email, consistent with brand impersonation tactics.

Sensitive environment variables and configuration files containing authentication tokens and credentials can be stolen by attackers, potentially leading to unauthorized access to cloud services, databases, and CI/CD pipelines. The disabling of TLS verification increases the risk of man-in-the-middle attacks during data exfiltration. The malicious package can compromise the security of systems where it is installed by leaking critical secrets and user information.

No official patch or remediation is currently documented for this package version. Users should avoid installing or using the 'meualelo' package version 99.0.0. Remove the package if already installed and rotate any potentially exposed credentials such as npm authentication tokens and cloud service keys. Monitor for any unauthorized access resulting from credential exposure. Check the vendor or npm advisories for updates or removal of the malicious package from the registry.