Malicious code in alelo-api (npm)
Malicious npm package alelo-api v99.0.0 contained code that exfiltrated environment variables, npm tokens, and local secrets to an attacker-controlled IP address during installation. The package appears to be a typosquat/dependency-confusion attack targeting the Alelo organization.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that ran `npm install alelo-api` during the package's availability; environment variables, npm tokens, and secrets in .env files were exfiltrated to attacker-controlled infrastructure.
- Ecosystems
- Attack vectors
- Affected entities
- alelo-api · 99.0.0
The npm package alelo-api version 99.0.0 contained malicious code designed to steal sensitive information from developers and CI/CD systems during installation. The attack was executed via two installation hooks: preinstall.js and postinstall.js (via index.js).
The preinstall.js script collected system metadata (hostname, username, platform, current working directory) and the entire process environment, then sent this data via HTTPS to https://209.99.185.109/preinstall with TLS verification disabled. The postinstall.js script performed more aggressive data collection, reading secret files from the current directory and parent directories (.env, .npmrc, package.json), capturing environment variables, executing system commands (whoami, id), and exfiltrating the aggregate to https://209.99.185.109/postinstall.
Evidence in the tarball—including a login.ps1 file referencing the publisher account oxy12@proton.me and a local publish workflow path—combined with the package name and version number (99.0.0), indicates this was a typosquat or dependency-confusion attack targeting the legitimate Alelo organization. Any developer or automated system that ran npm install alelo-api during the package's availability had their environment variables, npm authentication tokens, and local secrets exfiltrated to the attacker's infrastructure.
Indicators of compromise
- Packages
- alelo-api
- IPs
- 209.99.185.109
Remediation
- Immediately uninstall alelo-api from all systems and CI/CD pipelines
- Rotate all npm authentication tokens and credentials that may have been exposed
- Audit and rotate any secrets stored in .env files or .npmrc in affected working directories
- Review environment variable logs for any systems that installed this package
- Verify that the legitimate Alelo package (if it exists) is from the correct publisher and uses a different version scheme
- Implement npm package verification and allowlisting in CI/CD pipelines to prevent installation of unexpected packages
Sources
- GitHub Advisory GHSA-j3cg-h6v6-c6mc · GitHub Advisory Database
Cite this entry
"Malicious code in alelo-api (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-alelo-api-npm-r8ty1b
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in wct-st (npm)
The npm package wct-st contained malicious code in its postinstall lifecycle script that collected and exfiltrated host identifiers to a remote endpoint. The package name resembles the deprecated web-component-tester, consistent with a typosquatting attack.
npmCompromised packageTyposquatting