Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in alelo-core (npm)

The npm package alelo-core contained malicious preinstall and postinstall scripts that exfiltrated sensitive data including credentials, tokens, environment variables, and host identity to an attacker-controlled IP address. The package name resembled an internal/branded package, consistent with a dependency-confusion attack.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or CI/CD system that installed alelo-core from npm
Ecosystems
npm
Attack vectors
Compromised packageDependency confusion
Affected entities
  • alelo-corenpm package with malicious lifecycle scripts

The npm package alelo-core was found to contain malicious code in its lifecycle scripts. The preinstall.js script collected hostname, username, platform, current working directory, and the entire process.env, then sent this data via HTTPS (with certificate verification disabled) to https://209.99.185.109/preinstall.\n\nThe postinstall script (index.js) read sensitive files including .env, .npmrc, package.json, and parent directory .env files from the installer's tree, executed system commands (whoami and id), and exfiltrated the collected data to https://209.99.185.109/postinstall. The .npmrc file typically contains npm authentication tokens, and .env files hold application secrets, making this a high-impact credential theft attack.\n\nThe package name alelo-core resembles an internal or branded package (Alelo), consistent with a dependency-confusion attack strategy. A login.ps1 file in the package referenced the npm account oxy12@proton.me as the publishing identity. The destination IP address (209.99.185.109) is unrelated to any declared publisher, confirming malicious intent.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.

Indicators of compromise

Packages
  • alelo-core
IPs
  • 209.99.185.109

Remediation

  • Immediately uninstall alelo-core from all systems and CI/CD pipelines
  • Rotate all npm authentication tokens and credentials that may have been exposed
  • Review and rotate any secrets stored in .env files or .npmrc on affected machines
  • Audit process.env logs and environment variables for any unauthorized access or exfiltration
  • Check for any suspicious outbound HTTPS connections to 209.99.185.109 in network logs
  • Implement package verification and allowlisting policies to prevent dependency-confusion attacks
  • Use npm audit and supply chain security tools to detect similar malicious packages

Sources

  1. GitHub Advisory GHSA-pwg9-w9cr-cg23 · GitHub Advisory Database

Cite this entry

"Malicious code in alelo-core (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-alelo-core-npm-1j60wt

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in stillm4ddpocs-demo-sprocket (npm)

    The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.

    npmCompromised packageDependency confusion
  2. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  3. resolvedcritical

    Malicious code in lumen-pages-community (npm)

    lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.

    npmCompromised packageDependency confusion
  4. resolvedcritical

    Malicious code in @gfe/lx-watcher (npm)

    The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.

    npmDependency confusionCompromised package