Malicious code in alelo-auth (npm)
The npm package alelo-auth version 99.0.0 contained malicious preinstall and postinstall scripts that exfiltrated system information, environment variables, and credential files (.env, .npmrc) to an attacker-controlled IP address. The package appears to be a dependency-confusion attack targeting a private 'alelo-*' namespace.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed alelo-auth version 99.0.0 from npm.
- Ecosystems
- Attack vectors
- Affected entities
- alelo-auth · 99.0.0
The npm package alelo-auth (version 99.0.0) was found to contain malicious code in its preinstall and postinstall scripts. The preinstall.js script collects hostname, username, platform, current working directory, and the full process.env object, then sends this data via POST to https://209.99.185.109/preinstall with TLS verification disabled (rejectUnauthorized:false).
The postinstall script (index.js) performs more extensive data collection, reading local credential files including .env, .npmrc, package.json, and parent directory .env files. It also captures process.env and executes whoami and id commands via child_process, then POSTs the aggregated data to https://209.99.185.109/postinstall, again with TLS verification disabled.
The exfiltrated data includes credential-grade information: .npmrc typically contains npm authentication tokens, and .env files commonly contain cloud and API credentials. The bare IPv4 address endpoints show no association to a legitimate publisher, and the package metadata (generic 'internal utilities' description, alelo-* naming pattern) is consistent with a dependency-confusion attack targeting a private namespace.
The package was identified by Amazon Inspector and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- alelo-auth
- IPs
- 209.99.185.109
Remediation
- Immediately uninstall alelo-auth from all systems and projects
- Audit npm install logs to identify any systems that installed this package
- Rotate all npm authentication tokens and any credentials that may have been exposed
- Review .env files and cloud/API credentials for unauthorized access
- Scan systems for any persistence mechanisms or additional malicious artifacts
- Check outbound network connections to 209.99.185.109 for evidence of data exfiltration
- Update npm dependencies to remove any references to alelo-auth
- Consider implementing npm package verification and allowlisting in CI/CD pipelines
Sources
- GitHub Advisory GHSA-hgrh-c34j-mc7w · GitHub Advisory Database
Cite this entry
"Malicious code in alelo-auth (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-alelo-auth-npm-1dc02r
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in mtslink-depconf-probe-profileusername (npm)
The npm package mtslink-depconf-probe-profileusername contained malicious code designed to probe for internal namespace dependencies and exfiltrate install-time telemetry via DNS lookups to attacker-controlled infrastructure. The package was identified as a dependency-confusion probe targeting internal package namespaces.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in ranux-dev (npm)
ranux-dev, an npm package, contained malicious code that substituted a popular WhatsApp library dependency with arbitrary code from an unaffiliated GitHub account. The package was heavily obfuscated and designed to harvest WhatsApp sessions and credentials from installers.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in localize-extract (npm)
localize-extract@1.0.0 on npm contained malicious postinstall code that exfiltrated host identifiers to an attacker-controlled endpoint. The package name resembled @angular/localize, suggesting a dependency-confusion or typosquatting attack.
npmCompromised packageTyposquattingDependency confusion - containedcritical
Malicious code in ranux-cloud (npm)
The npm package ranux-cloud contains malicious code that executes hidden payloads at import time via encrypted blob decryption and obfuscation. Additionally, the package redirects the legitimate @whiskeysockets/baileys dependency to an attacker-controlled GitHub repository, enabling arbitrary code execution during installation.
npmCompromised packageDependency confusion