Malicious code in alelo-utils (npm)
Malicious code in alelo-utils npm package version 99.0.0 exfiltrates system information and credentials during installation. The package uses preinstall and postinstall scripts to collect hostname, username, environment variables, .npmrc tokens, .env files, and cloud credentials, sending them to an attacker-controlled IP address.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed alelo-utils version 99.0.0
- Ecosystems
- Attack vectors
- Affected entities
- alelo-utils · 99.0.0
The alelo-utils npm package version 99.0.0 contains malicious preinstall and postinstall scripts that execute during package installation. The preinstall.js script collects system metadata (hostname, username, platform, current working directory) and the full process.env, then POSTs this data to https://209.99.185.109/preinstall with TLS verification disabled.
The postinstall/index.js script reads sensitive configuration files (.env, .npmrc, package.json, and parent-directory .env files) and executes whoami and id commands via child_process, exfiltrating this information to https://209.99.185.109/postinstall over the same unverified TLS channel. The .npmrc file typically contains npm authentication tokens, and .env files commonly hold cloud and API credentials.
Package metadata indicates a dependency-confusion attack pattern: the package is published at version 99.0.0 under the name alelo-utils, and a bundled login.ps1 script references an npm publish workflow under the personal account oxy12@proton.me, which does not match the claimed 'Alelo Dev Team' author. The destination IP address (209.99.185.109) is unrelated to any documented publisher.
This incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- alelo-utils@99.0.0
- IPs
- 209.99.185.109
Remediation
- Immediately uninstall alelo-utils version 99.0.0 from all systems
- Rotate all npm authentication tokens (_authToken values in .npmrc)
- Rotate all cloud and API credentials that may have been exposed in .env files
- Audit environment variables and process.env contents for sensitive data that may have been exfiltrated
- Review npm package.json dependencies to ensure no other malicious packages are present
- Monitor the attacker IP address (209.99.185.109) for any outbound connections from your systems
- Implement npm package scanning and verification in your CI/CD pipeline to detect malicious packages before installation
Sources
- GitHub Advisory GHSA-chg6-4g6x-82gw · GitHub Advisory Database
Cite this entry
"Malicious code in alelo-utils (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-alelo-utils-npm-dfx34g
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in localize-extract (npm)
localize-extract@1.0.0 on npm contained malicious postinstall code that exfiltrated host identifiers to an attacker-controlled endpoint. The package name resembled @angular/localize, suggesting a dependency-confusion or typosquatting attack.
npmCompromised packageTyposquattingDependency confusion - containedcritical
Malicious code in ranux-cloud (npm)
The npm package ranux-cloud contains malicious code that executes hidden payloads at import time via encrypted blob decryption and obfuscation. Additionally, the package redirects the legitimate @whiskeysockets/baileys dependency to an attacker-controlled GitHub repository, enabling arbitrary code execution during installation.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in gaarf-node-bq (npm)
gaarf-node-bq is a malicious npm package that acts as a dependency-confusion/typosquat canary targeting Google's internal gaarf package. The package's postinstall script collects host metadata and exfiltrates it to an external endpoint without user consent.
npmDependency confusionTyposquattingCompromised package - resolvedcritical
Malicious code in ngsw-config (npm)
A malicious npm package named ngsw-config was published to shadow Angular's legitimate tooling. The package's postinstall script collected and exfiltrated host identifiers (hostname, platform, architecture, Node version, package/lifecycle name, timestamp) to a hardcoded endpoint without consent or documentation, targeting dependency-confusion scenarios in internal build systems.
npmCompromised packageTyposquattingDependency confusion