MAL-2026-14021

    Dashboard / Malicious Package / MAL-2026-14021

    MAL-2026-14021

    Published: 14 Aug 2026Last Modified: 14 Aug 2026

    Summary: Malicious code in alelo-auth (npm)

    Details: Source: amazon-inspector (b2585f71b11041c61a65dffdaa569b2e77a0e4415bd73e34a3142a61ad0f6c4e) The package's preinstall script (preinstall.js) collects hostname, username, platform, current working directory, and the full process.env, then POSTs the JSON payload to https://209.99.185.109/preinstall with TLS verification disabled. The postinstall path (index.js) additionally reads local credential files (.env,.npmrc, package.json,../.env,../../.env), captures process.env, runs whoami/id via child_process, and POSTs the aggregated data to https://209.99.185.109/postinstall, also with rejectUnauthorized:false. Both endpoints are a bare IPv4 address with no association to a public publisher..npmrc typically contains npm auth tokens and.env commonly contains cloud/API credentials, so the transmitted data is credential-grade. Package metadata (version 99.0.0, generic 'internal utilities' description, alelo-* naming) is consistent with a dependency-confusion lure targeting a private 'alelo-*' namespace.

    References: https://www.npmjs.com/package/alelo-auth/v/99.0.0, https://www.npmjs.com/package/alelo-auth/v/99.0.2

    Affected packages

    Package

    Name: alelo-auth

    Purl: pkg:npm/alelo-auth

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.0
    99.0.2
    MAL-2026-14021 | CVE-DB