OpenSSF/OSV advisory MAL-2026-14028 confirms this npm version as malicious. On npm install, preinstall.js collects hostname, username, platform, cwd and the full process.env and POSTs the JSON body to https://209.99.185.109/preinstall with TLS verification disabled (rejectUnauthorized:false). A companion postinstall/index.js path reads.env,.npmrc, package.json, and parent-directory.env files (../.env,../../.env), runs whoami/id via child_process, and POSTs the collected contents to...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in alelo-utils (npm)
Details
On npm install, preinstall.js collects hostname, username, platform, cwd and the full process.env and POSTs the JSON body to https://209.99.185.109/preinstall with TLS verification disabled (rejectUnauthorized:false). A companion postinstall/index.js path reads.env,.npmrc, package.json, and parent-directory.env files (../.env,../../.env), runs whoami/id via child_process, and POSTs the collected contents to https://209.99.185.109/postinstall over the same TLS-disabled channel. The destination is a bare IPv4 endpoint unrelated to any documented publisher. Package metadata shows a dependency-confusion shape: name alelo-utils published at version 99.0.0, and a bundled login.ps1 references an npm publish workflow under the personal account oxy12@proton.me, which does not match the claimed 'Alelo Dev Team' author..npmrc typically contains npm _authToken values and.env commonly holds cloud/API credentials, so this install-time flow directly exfiltrates installer credentials.
Decision reason
OpenSSF Malicious Packages via OSV confirms alelo-utils@99.0.0 as malicious (MAL-2026-14028): Malicious code in alelo-utils (npm)