Malicious code in alelo-payment (npm)
The npm package alelo-payment (version 99.0.0) contained malicious code that exfiltrated sensitive environment variables, credentials, and system information during installation. The package appears to be a typosquat or dependency-confusion attack targeting an internal Alelo utility.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system installing the malicious alelo-payment package from npm
- Ecosystems
- Attack vectors
- Affected entities
- alelo-payment · 99.0.0
The npm package alelo-payment version 99.0.0 contained malicious preinstall and postinstall scripts that collected and exfiltrated sensitive data from developer machines and CI/CD environments. The preinstall.js script captured hostname, username, platform, working directory, and the full process.env, sending this data via HTTPS to 209.99.185.109/preinstall with TLS verification disabled (rejectUnauthorized:false).
The postinstall script performed additional reconnaissance, reading .env, ../.env, ../../.env, .npmrc, and package.json files from the installation directory. It also captured output from whoami and id commands along with the full process.env, posting the collected bundle to 209.99.185.109/postinstall with TLS verification disabled. The .npmrc file typically contains npm authentication tokens, while .env files commonly hold CI/CD secrets and cloud credentials.
A bundled PowerShell artifact referenced publishing under the npm account oxy12@proton.me. The package name and version number (99.0.0) suggest this was a typosquat or dependency-confusion attack targeting an internal Alelo utility, with no legitimate functionality provided. The package was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- alelo-payment
- IPs
- 209.99.185.109
Remediation
- Immediately uninstall alelo-payment from all systems and CI/CD pipelines
- Rotate all npm authentication tokens (_authToken values in .npmrc)
- Rotate all CI/CD secrets and cloud credentials that may have been exposed
- Review npm account activity and enable 2FA on npm accounts
- Audit process.env logs and system access logs for the affected systems during the installation window
- Check for any unauthorized package publishes or account modifications under oxy12@proton.me
- Monitor the IP address 209.99.185.109 for any data exfiltration attempts
Sources
- GitHub Advisory GHSA-4whx-hjpv-g8xf · GitHub Advisory Database
Cite this entry
"Malicious code in alelo-payment (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-alelo-payment-npm-tt40r5
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package