Malicious code in alelo-common (npm)
The npm package alelo-common contained malicious code that auto-executed during installation, exfiltrating system information, credentials, and environment variables to a remote IP address. The package name resembled a private scope, consistent with a dependency-confusion attack.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed alelo-common via npm
- Ecosystems
- Attack vectors
- Affected entities
- alelo-commonnpm package containing malicious preinstall and postinstall scripts
The npm package alelo-common contained malicious preinstall and postinstall lifecycle scripts that automatically executed during package installation. The preinstall.js script collected hostname, username, platform, current working directory, and full process environment variables, then sent this data via HTTP POST to https://209.99.185.109/preinstall with TLS certificate validation disabled.
The postinstall script (index.js) performed more extensive credential harvesting, reading .env, .npmrc, package.json, and parent directory .env files from the installation context. It also executed whoami and id commands and gathered process environment variables, sending the aggregated payload to https://209.99.185.109/postinstall over the same TLS-disabled channel. The .npmrc read specifically targeted npm authentication tokens, while .env reads captured cloud, database, and API credentials.
The destination was a bare IP address with no legitimate relationship to any publisher, and TLS verification was deliberately disabled (rejectUnauthorized: false), indicating intentional malicious design. The package name resembled a private or internal scope, consistent with a dependency-confusion attack pattern designed to lure developers into installing the malicious package.
Indicators of compromise
- Packages
- alelo-common
- IPs
- 209.99.185.109
Remediation
- Immediately uninstall alelo-common from all development environments and CI/CD systems
- Rotate all credentials and tokens that may have been exposed, including npm _authToken, cloud credentials, database passwords, and API keys
- Review npm install logs and audit trails to identify which systems and users installed this package
- Implement npm package verification and scanning in CI/CD pipelines to detect malicious lifecycle scripts
- Use npm audit and security scanning tools to identify other potentially compromised dependencies
- Consider using npm package lockfiles and integrity verification to prevent unexpected package installations
Sources
- GitHub Advisory GHSA-4w9c-fcxm-hf28 · GitHub Advisory Database
Cite this entry
"Malicious code in alelo-common (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-alelo-common-npm-riy3ie
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in ssb-test-package (npm)
ssb-test-package@1.0.0 on npm contains malicious code designed as a dependency-confusion proof-of-concept. A preinstall hook executes arbitrary code on installation, performing host reconnaissance and writing results to a local file.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in mtslink-depconf-probe-profileusername (npm)
The npm package mtslink-depconf-probe-profileusername contained malicious code designed to probe for internal namespace dependencies and exfiltrate install-time telemetry via DNS lookups to attacker-controlled infrastructure. The package was identified as a dependency-confusion probe targeting internal package namespaces.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in bcc-design (npm)
bcc-design@9999.0.0 on npm is a dependency-confusion beacon package with no legitimate functionality. Its postinstall script exfiltrates the installer's hostname and system metadata to an attacker-controlled IP endpoint.
npmDependency confusionCompromised package - containedcritical
Malicious code in bcc-design-icons (npm)
bcc-design-icons@9999.0.0 on npm contains malicious postinstall script that exfiltrates hostname and package name to attacker-controlled IP 91.201.215.48:8000. The package lacks expected icon-library functionality and exhibits characteristics of a dependency-confusion attack targeting internal/private npm installers.
npmDependency confusionCompromised package