Malicious code in alelo-sdk (npm)

alelo-sdk version 99.0.0 published to npm contains malicious code in its lifecycle scripts (preinstall.js and postinstall/index.js). The preinstall script collects system information including hostname, username, platform, current working directory, and the full process environment, then POSTs this data to https://209.99.185.109/preinstall with TLS certificate verification disabled.\n\nThe postinstall script performs additional credential harvesting by reading .env, .npmrc, and parent-directory .env files, executing whoami and id commands, and exfiltrating the collected content to https://209.99.185.109/postinstall. Since .npmrc files typically contain npm publish tokens and .env files contain cloud and API credentials, any environment where this package is installed (developer workstation or CI/CD pipeline) has its secrets compromised.\n\nThe package metadata (name 'alelo-sdk', version 99.0.0, description 'internal utilities', author 'Alelo Dev Team') follows the canonical dependency confusion attack pattern, targeting a private 'alelo' internal scope with an artificially inflated version number to trick dependency resolution into installing the malicious public package instead of the legitimate private one.\n\nThe incident was identified by Amazon Inspector and credited to the OpenSSF malicious packages project.