alelo-client@99.0.0

Analysis

alelo-client@99.0.0 runs two lifecycle hooks on install that exfiltrate host data and credentials to a remote server. The preinstall hook (preinstall.js) POSTs the hostname, username, platform, working directory, and the full process environment to hxxps://209[.]99[.]185[.]109:443/preinstall. The postinstall hook (index.js) additionally reads the contents of .env, .npmrc, package.json, and parent-directory .env files (up to 5000 characters each) and POSTs them, along with the output of whoami and id, to hxxps://209[.]99[.]185[.]109:443/postinstall. The connection disables TLS certificate verification. This steals npm tokens and environment secrets from the installer's machine.