GCVE-110-OSM-2026-10472

alelo-client@99.0.0 is a dependency-confusion / impersonation package targeting an internal 'Alelo' namespace (version 99.0.0, generic 'internal utilities' description). On npm install, preinstall.js collects hostname, username, platform, cwd, and the full process.env and POSTs the JSON payload over HTTPS to the bare-IP endpoint https://209.99.185.109/preinstall with TLS verification disabled (rejectUnauthorized:false). A postinstall path additionally reads.env,.npmrc, package.json, and parent-directory.env files via fs.readFileSync, executes whoami/id via child_process, and POSTs the collected contents to https://209.99.185.109/postinstall with certificate verification disabled. The tarball also ships a login.ps1 referencing an external npm account (oxy12@proton.me). The.npmrc read yields the installer's npm auth token and the.env reads yield application secrets; both leave the installer's machine to an attacker-controlled bare IP at install time. Judge assessment: This is a credential- and system-exfiltration installer dropper consistent with a dependency-confusion/impersonation attack against an internal 'Alelo' namespace: the package runs code on install via both `preinstall.js` and `index.js`. The `preinstall.js` payload collects `hostname`, `os.userInfo().username`, `platform`, `cwd`, and the full `process.env`, then POSTs it to `alelo1786663101.requestcatcher.com/preinstall`; the postinstall path also reads `.env`, `.npmrc`, and parent-directory `.env` files and sends them out, which is direct secret theft. The use of `requestcatcher.com`, `execSync('whoami')`, and `child_process` in an install hook shows clear attacker intent to harvest secrets and fingerprint victims, not a legitimate utility. I would treat this as confirmed malicious code from a new publisher account targeting developers during npm install. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in preinstall.js: "process.env, timestamp: new Date().toISOString() }; const req = https.request({ ..." - Payload Download from Paste Service in index.js: "requestcatcher.com" - System Information Exfiltration in preinstall.js: "os.hostname(), user: os.userInfo().username, platform: os.platform(), cwd: proce..." - HTTP Data Exfiltration in preinstall.js: "os.userInfo().username, platform: os.platform(), cwd: process.cwd(), env: proces..." - Payload Download from Paste Service in preinstall.js: "requestcatcher.com" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" - Network Request in preinstall.js: "https.request(" (+1 more) ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES preinstall.js