The alelo-core npm package versions 99.0.0, 99.0.1, and 99.0.2 contain malicious lifecycle scripts that execute during installation. These scripts collect sensitive environment data including host identity, npm authentication tokens, and application secrets, then exfiltrate this information to an untrusted external IP address over HTTPS with certificate verification disabled. The package appears to be a dependency confusion lure, masquerading as an internal or branded package. No official patch or remediation guidance is currently available.