The alelo-services npm package version 99.0.0 and 99.0.2 contains malicious code that executes during both preinstall and postinstall lifecycle scripts. These scripts collect sensitive environment data including hostnames, usernames, environment variables, npm authentication tokens, and cloud/CI credentials, then send this information to a hardcoded IP address with disabled TLS verification. The package appears to be a dependency confusion attack targeting private scope names with generic metadata to lure victims.