MAL-2026-14021
Malicious code in alelo-auth (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (b2585f71b11041c61a65dffdaa569b2e77a0e4415bd73e34a3142a61ad0f6c4e) The package's preinstall script (preinstall.js) collects hostname, username, platform, current working directory, and the full process.env, then POSTs the JSON payload to https://209.99.185.109/preinstall with TLS verification disabled. The postinstall path (index.js) additionally reads local credential files (.env,.npmrc, package.json,../.env,../../.env), captures process.env, runs whoami/id via child_process, and POSTs the aggregated data to https://209.99.185.109/postinstall, also with rejectUnauthorized:false. Both endpoints are a bare IPv4 address with no association to a public publisher..npmrc typically contains npm auth tokens and.env commonly contains cloud/API credentials, so the transmitted data is credential-grade. Package metadata (version 99.0.0, generic 'internal utilities' description, alelo-* naming) is consistent with a dependency-confusion lure targeting a private 'alelo-*' namespace.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for alelo-auth (npm). Pin to a known-safe version or switch to an alternative.