Malicious code in alelo-core (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d98bac664d9feb9d1d326fb6d724b9a62631267258ae81e69c5b4c0a057ba0f6) The package runs malicious lifecycle scripts on npm install. preinstall.js collects hostname, username, platform, cwd, and the entire process.env, then POSTs the JSON payload over HTTPS with certificate verification disabled to https://209.99.185.109/preinstall. index.js (postinstall) reads.env,.npmrc, package.json,../.env, and../../.env from the installer's tree, executes `whoami` and `id`, dumps process.env, and POSTs the collected data to https://209.99.185.109/postinstall over HTTPS with certificate verification disabled. The destination is a bare IP unrelated to any declared publisher;.npmrc typically contains npm auth tokens and.env files hold application secrets, so installation of this package results in exfiltration of credentials, tokens, and host identity from the installer's machine. A shipped login.ps1 references npm account oxy12@proton.me as the publishing identity. The package name resembles an internal/branded package (Alelo), consistent with a dependency-confusion lure.
MAL-2026-14024
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-14024
alelo-core
Source reference: /affected/0/package/name
- Affected versions
- 99.0.2
Source reference:
/affected/0/versions99.0.0Source reference:
/affected/0/versions99.0.1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "alelo-core",
"purl": "pkg:npm/alelo-core",
"ecosystem": "npm"
},
"versions": [
"99.0.2",
"99.0.0",
"99.0.1"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/alelo-core/MAL-2026-14024.json",
"indicators": {
"evidence_files": [
{
"path": "preinstall.js",
"tlsh": "b0f084f491a9eab02e7857c0e09aa40296b3e1113b277cf4a9e90249678d1e41172cf6",
"sha256": "b37206713fc25fedb6193f5d1ac2eecf834e826eed4c03b3bc570385a554e28d"
},
{
"path": "index.js",
"tlsh": "4311abf452a5b3b06ab556c4e5ee50016263e2023e27b5f0b9ec02556b499b805b3df4",
"sha256": "70a8739590ceacd616e00eef3ccbe975d174c5cf731addb93da8eb7ad8a2fd5f"
},
{
"path": "package.json",
"tlsh": "10d0c2384811a6736dcc1b990827400675e18f9f48d87c14779b001856de37784bf21b",
"sha256": "2c34ce0d6c14bd8e06ae2ae9339f137d3ad1d091e8245688b84280f5c733905b"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "b49d628a297025855cf1363963b42ca28fea3fb3",
"sha512_sri": "sha512-g3SQn5Lc4IzHQgCMx7wwsDFzq+spw6lc3xYjxyx741VyNo8VAfeGnrQpugvvny81eKrJKvUMwjfaevkrxf3kTA=="
},
"filename": "alelo-core-99.0.2.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #10985 · Revision 1
- Added to Heist Feed
- Publisher date