alelo-utils@99.0.0

Analysis

alelo-utils@99.0.0 runs two lifecycle hooks on install. The preinstall hook (preinstall.js) and postinstall hook (index.js) collect the hostname, username, home directory, platform, architecture, working directory, the full process environment (including any NPM_TOKEN, GITHUB_TOKEN, and other credentials), and read the contents of .env, .npmrc, and package.json files (up to 5000 characters each), plus the output of whoami and id. All collected data is POSTed as JSON over HTTPS to 209[.]99[.]185[.]109:443 at the /preinstall and /postinstall paths, with TLS certificate verification disabled. The package is a fresh high-version (99.0.0) publish with no legitimate utility functionality.