alelo-auth@99.0.2

Analysis

The package's preinstall and postinstall hooks (preinstall.js and index.js) exfiltrate the full process environment to the request-capture host alelo1786663101[.]requestcatcher[.]com, POSTing JSON to /preinstall and /postinstall. The stolen payload includes the installer's credentials — GITHUB_TOKEN, NPM_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, OPENAI_API_KEY, ANTHROPIC_API_KEY, STRIPE_SECRET_KEY, SLACK_TOKEN, TWILIO_AUTH_TOKEN, SENDGRID_API_KEY, HF_TOKEN, DIGITALOCEAN_TOKEN, CLOUDFLARE_API_TOKEN, NETLIFY_AUTH_TOKEN, VERCEL_TOKEN, GITLAB_TOKEN, CI_JOB_TOKEN, CI_REGISTRY_PASSWORD, DOCKER_PASSWORD, PYPI_TOKEN, CARGO_REGISTRY_TOKEN — along with hostname, username, platform, and working directory. requestcatcher[.]com is a request-capture (oast-style) service, so the collected credentials are delivered to the attacker. The exfiltration runs automatically on npm install via the lifecycle hooks.