The npm package alelo-common version 99.0.0 contains malicious code that auto-executes during installation via preinstall and postinstall lifecycle scripts. These scripts collect sensitive environment information, including host details, user credentials, and environment variables, and exfiltrate this data to an untrusted IP address over TLS connections with certificate validation disabled. The package appears to be designed as a dependency confusion lure, mimicking a private/internal package name to trick users into installing it.