MAL-2026-14024

    Dashboard / Malicious Package / MAL-2026-14024

    MAL-2026-14024

    Published: 14 Aug 2026Last Modified: 14 Aug 2026

    Summary: Malicious code in alelo-core (npm)

    Details: Source: amazon-inspector (d98bac664d9feb9d1d326fb6d724b9a62631267258ae81e69c5b4c0a057ba0f6) The package runs malicious lifecycle scripts on npm install. preinstall.js collects hostname, username, platform, cwd, and the entire process.env, then POSTs the JSON payload over HTTPS with certificate verification disabled to https://209.99.185.109/preinstall. index.js (postinstall) reads.env,.npmrc, package.json,../.env, and../../.env from the installer's tree, executes `whoami` and `id`, dumps process.env, and POSTs the collected data to https://209.99.185.109/postinstall over HTTPS with certificate verification disabled. The destination is a bare IP unrelated to any declared publisher;.npmrc typically contains npm auth tokens and.env files hold application secrets, so installation of this package results in exfiltration of credentials, tokens, and host identity from the installer's machine. A shipped login.ps1 references npm account [email protected] as the publishing identity. The package name resembles an internal/branded package (Alelo), consistent with a dependency-confusion lure.

    References: https://www.npmjs.com/package/alelo-core/v/99.0.2, https://www.npmjs.com/package/alelo-core/v/99.0.0, https://www.npmjs.com/package/alelo-core/v/99.0.1

    Affected packages

    Package

    Name: alelo-core

    Purl: pkg:npm/alelo-core

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.2
    99.0.0
    99.0.1