GCVE-110-OSM-2026-10480

alelo-services@99.0.0 runs both preinstall and postinstall lifecycle scripts that harvest installer data and POST it to the hardcoded bare-IP endpoint https://209.99.185.109 with TLS verification disabled (rejectUnauthorized:false). preinstall.js collects hostname, username, platform, cwd, and the entire process.env and sends the JSON to https://209.99.185.109/preinstall. index.js (also the package main, executed on postinstall) reads.env,.npmrc, package.json,../.env, and../../.env from the install directory, runs whoami/id, collects process.env, and POSTs the contents to https://209.99.185.109/postinstall. The.npmrc read captures npm auth tokens; the.env reads capture CI and cloud credentials from the installer and any parent project directories. Package metadata is generic ("internal utilities") and the 99.0.0 version is consistent with a dependency-confusion lure targeting a private scope name. Judge assessment: This is credential and environment theft staged as an npm install-time payload: the attacker model is a dependency-confusion or supply-chain compromise that abuses lifecycle hooks to harvest installer data. The entrypoint `preinstall.js` runs on install and POSTs `hostname`, `user`, `cwd`, and the entire `process.env` to `alelo1786663101.requestcatcher.com/preinstall`, while `index.js` runs on postinstall and additionally reads `.env`, `.npmrc`, and parent-directory `.env` files before exfiltrating them. The presence of `execSync('whoami')`, `https.request(...)`, and the hardcoded `requestcatcher.com` exfil host confirms both data collection and network exfiltration, not a benign utility. The very new publisher account and version-lure naming (`99.0.2` with related packages like `alelo-api`, `alelo-auth`, `alelo-sdk`) further support malicious supply-chain intent. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in preinstall.js: "process.env, timestamp: new Date().toISOString() }; const req = https.request({ ..." - Payload Download from Paste Service in index.js: "requestcatcher.com" - System Information Exfiltration in preinstall.js: "os.hostname(), user: os.userInfo().username, platform: os.platform(), cwd: proce..." - HTTP Data Exfiltration in preinstall.js: "os.userInfo().username, platform: os.platform(), cwd: process.cwd(), env: proces..." - Payload Download from Paste Service in preinstall.js: "requestcatcher.com" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" - Network Request in preinstall.js: "https.request(" (+1 more) ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES preinstall.js