Malicious code in meualelo (npm)
The npm package meualelo version 99.0.0 contained malicious code in preinstall.js and index.js that collected and exfiltrated sensitive system information, credentials, and environment variables to a hardcoded IP endpoint (209.99.185.109). The package impersonated the Alelo brand and was published under a personal Proton Mail account.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed meualelo version 99.0.0; credentials and environment data exfiltrated to attacker-controlled server.
- Ecosystems
- Attack vectors
- Affected entities
- meualelo · 99.0.0
The npm package meualelo version 99.0.0 was published with embedded malicious code designed to exfiltrate sensitive data from developer machines and CI/CD environments. The preinstall.js script collected hostname, username, platform, current working directory, and the full process environment, then sent this data via HTTPS (with TLS verification disabled) to https://209.99.185.109/preinstall.
The postinstall script (index.js) performed additional reconnaissance, reading .env, .npmrc, package.json, and parent-directory .env files, executing whoami and id commands, and exfiltrating all collected data plus the full process environment to https://209.99.185.109/postinstall. The .npmrc file typically contains npm authentication tokens, while .env files commonly hold cloud, database, and CI credentials.
The package was presented as authored by 'Alelo Dev Team' (brand impersonation), but a bundled login.ps1 script referenced a personal proton.me email address associated with npm publishing, indicating the true attacker identity. The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- meualelo@99.0.0
- IPs
- 209.99.185.109
Remediation
- Immediately uninstall meualelo version 99.0.0 from all systems and CI/CD pipelines
- Rotate all npm authentication tokens (_authToken) stored in .npmrc files
- Rotate all credentials stored in .env files, including cloud provider keys, database passwords, and CI/CD secrets
- Audit npm package.json files and lock files for any other suspicious dependencies
- Review access logs for the attacker IP 209.99.185.109 to identify when the package was installed
- Scan systems for any additional artifacts or persistence mechanisms left by the malicious package
- Implement npm package verification and scanning in CI/CD pipelines to detect malicious packages before installation
Sources
- GitHub Advisory GHSA-m6g5-fpx6-6x7v · GitHub Advisory Database
Cite this entry
"Malicious code in meualelo (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-meualelo-npm-1aiikb
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit