alelo-payment@99.0.0

Analysis

The package's preinstall and postinstall hooks (preinstall.js and index.js) collect host metadata — hostname, username, home directory, platform, architecture, cwd, and the full process environment — and POST it to 209[.]99[.]185[.]109:443 at paths /preinstall and /postinstall. The postinstall hook additionally reads the contents of .env, .npmrc, package.json, ../.env and ../../.env (up to 5000 characters each) and runs whoami and id, exfiltrating all of it to the same host. The TLS connection is made with certificate verification disabled. This steals the installer's environment variables and credential files (.npmrc, .env) and sends them to a remote server.