GCVE-110-OSM-2026-10477

The package runs malicious lifecycle scripts on npm install. preinstall.js collects hostname, username, platform, cwd, and the entire process.env, then POSTs the JSON payload over HTTPS with certificate verification disabled to https://209.99.185.109/preinstall. index.js (postinstall) reads.env,.npmrc, package.json,../.env, and../../.env from the installer's tree, executes `whoami` and `id`, dumps process.env, and POSTs the collected data to https://209.99.185.109/postinstall over HTTPS with certificate verification disabled. The destination is a bare IP unrelated to any declared publisher;.npmrc typically contains npm auth tokens and.env files hold application secrets, so installation of this package results in exfiltration of credentials, tokens, and host identity from the installer's machine. A shipped login.ps1 references npm account oxy12@proton.me as the publishing identity. The package name resembles an internal/branded package (Alelo), consistent with a dependency-confusion lure. Judge assessment: This is a credential-and-environment theft implant delivered through npm lifecycle hooks: `package.json` runs `preinstall.js` and `index.js` on install, and both files collect `process.env`, hostname, username, platform, cwd, and local secrets like `.env` and `.npmrc` before POSTing them to `alelo1786663101.requestcatcher.com`. The postinstall path also invokes `child_process.execSync('whoami')`, reinforcing that the attacker model is data theft from the installer’s machine, not a normal utility library. The OSV advisory’s claims are corroborated by the actual `entrypoint` and `exfil` file contents, and the package’s fresh account/publisher metadata fits a dependency-confusion lure under the `Alelo` brand. This should be treated as confirmed malicious install-time exfiltration and submitted to OSM. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in preinstall.js: "process.env, timestamp: new Date().toISOString() }; const req = https.request({ ..." - Payload Download from Paste Service in index.js: "requestcatcher.com" - System Information Exfiltration in preinstall.js: "os.hostname(), user: os.userInfo().username, platform: os.platform(), cwd: proce..." - HTTP Data Exfiltration in preinstall.js: "os.userInfo().username, platform: os.platform(), cwd: process.cwd(), env: proces..." - Payload Download from Paste Service in preinstall.js: "requestcatcher.com" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" - Network Request in preinstall.js: "https.request(" (+1 more) ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES preinstall.js