alelo-sdk@99.0.0

Analysis

alelo-sdk@99.0.0 runs two install-time hooks that exfiltrate host data and credentials to a hardcoded server. The preinstall hook POSTs the hostname, username, platform, working directory, and the full process environment (including any NPM_TOKEN/GITHUB_TOKEN and other secrets) to hxxps://209[.]99[.]185[.]109:443/preinstall. The postinstall hook additionally reads the contents of .env, .npmrc, and package.json files (including parent-directory variants, up to 5000 characters each), runs whoami and id, and POSTs all collected data to hxxps://209[.]99[.]185[.]109:443/postinstall. Both requests use HTTPS with certificate verification disabled. The package is a fresh "internal SDK" name published at version 99.0.0.