Malicious code in alelo-services (npm)

alelo-services@99.0.0 published on npm contained malicious lifecycle scripts designed to harvest sensitive data from the installer environment. The preinstall.js script collected hostname, username, platform, working directory, and the entire process.env, sending this data via POST to https://209.99.185.109/preinstall with TLS verification disabled.\n\nThe postinstall script (index.js, also the package main) read .env, .npmrc, package.json, and parent directory .env files from the installation context, executed whoami and id commands, and exfiltrated the collected data to https://209.99.185.109/postinstall. The .npmrc read was particularly dangerous as it captures npm authentication tokens; the .env reads targeted CI and cloud credentials.\n\nThe package metadata was generic ("internal utilities") and the version number 99.0.0 is consistent with a dependency-confusion attack luring developers to install from the public npm registry instead of a private scope. The incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.