MAL-2026-14024

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/alelo-core/MAL-2026-14024.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14024
Published
2026-08-14T14:07:40Z
Modified
2026-08-14T14:46:35.999596994Z
Summary
Malicious code in alelo-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d98bac664d9feb9d1d326fb6d724b9a62631267258ae81e69c5b4c0a057ba0f6)

The package runs malicious lifecycle scripts on npm install. preinstall.js collects hostname, username, platform, cwd, and the entire process.env, then POSTs the JSON payload over HTTPS with certificate verification disabled to https://209.99.185.109/preinstall. index.js (postinstall) reads.env,.npmrc, package.json,../.env, and../../.env from the installer's tree, executes whoami and id, dumps process.env, and POSTs the collected data to https://209.99.185.109/postinstall over HTTPS with certificate verification disabled. The destination is a bare IP unrelated to any declared publisher;.npmrc typically contains npm auth tokens and.env files hold application secrets, so installation of this package results in exfiltration of credentials, tokens, and host identity from the installer's machine. A shipped login.ps1 references npm account oxy12@proton.me as the publishing identity. The package name resembles an internal/branded package (Alelo), consistent with a dependency-confusion lure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017768",
            "import_time": "2026-08-14T14:28:07.483533521Z",
            "sha256": "5f210ef894e67fa4691cd2b569e9d6386c7933c8f64a5e237e3b216fa96bf012",
            "modified_time": "2026-08-14T14:13:17Z",
            "source": "amazon-inspector",
            "versions": [
                "99.0.2"
            ]
        },
        {
            "id": "IN-MAL-2026-017731",
            "import_time": "2026-08-14T14:28:03.716169722Z",
            "sha256": "d4cdff1725c8ee5c20049bfc76dd1b700256ab64647dbf4c110b36835cd819f6",
            "versions": [
                "99.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-14T14:07:40Z"
        },
        {
            "id": "IN-MAL-2026-017775",
            "import_time": "2026-08-14T14:28:08.159143404Z",
            "sha256": "d98bac664d9feb9d1d326fb6d724b9a62631267258ae81e69c5b4c0a057ba0f6",
            "versions": [
                "99.0.1"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-14T14:14:21Z"
        }
    ]
}
References
Credits

Affected packages

npm / alelo-core

Package

Name
alelo-core
View open source insights on deps.dev
Purl
pkg:npm/alelo-core

Affected ranges

Affected versions

99.*
99.0.0
99.0.1
99.0.2

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "preinstall.js",
            "tlsh": "b0f084f491a9eab02e7857c0e09aa40296b3e1113b277cf4a9e90249678d1e41172cf6",
            "sha256": "b37206713fc25fedb6193f5d1ac2eecf834e826eed4c03b3bc570385a554e28d"
        },
        {
            "path": "index.js",
            "tlsh": "4311abf452a5b3b06ab556c4e5ee50016263e2023e27b5f0b9ec02556b499b805b3df4",
            "sha256": "70a8739590ceacd616e00eef3ccbe975d174c5cf731addb93da8eb7ad8a2fd5f"
        },
        {
            "path": "package.json",
            "tlsh": "10d0c2384811a6736dcc1b990827400675e18f9f48d87c14779b001856de37784bf21b",
            "sha256": "2c34ce0d6c14bd8e06ae2ae9339f137d3ad1d091e8245688b84280f5c733905b"
        }
    ],
    "package_integrity": [
        {
            "filename": "alelo-core-99.0.2.tgz",
            "hashes": {
                "sha1": "b49d628a297025855cf1363963b42ca28fea3fb3",
                "sha512_sri": "sha512-g3SQn5Lc4IzHQgCMx7wwsDFzq+spw6lc3xYjxyx741VyNo8VAfeGnrQpugvvny81eKrJKvUMwjfaevkrxf3kTA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/alelo-core/MAL-2026-14024.json"