alelo-services@99.0.0

Analysis

The package runs two install-time hooks that exfiltrate the installer's environment and credentials to a hardcoded remote host. The preinstall hook collects the hostname, username, platform, working directory and the full process environment and POSTs them to hxxps://209[.]99[.]185[.]109:443/preinstall. The postinstall hook additionally reads the installer's .npmrc, .env, package.json and parent-directory .env files (up to 5000 characters each), runs whoami and id, and POSTs all collected data to hxxps://209[.]99[.]185[.]109:443/postinstall. The .npmrc read exposes the installer's npm publish/auth token; the env dump exposes any NPM_TOKEN, GITHUB_TOKEN, cloud credentials and other secrets present in the environment.