MAL-2026-14020Published

Malicious code in alelo-api (npm)

Exploitation and risk

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

Which CVEs have scores here?

This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

osv · MAL-2026-14020

Published

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0e520850363c3164a09e0772022283849a0abd1b6f60e9168f4a5fd3ff338886) The package fires attacker-controlled code on `npm install` via both `preinstall.js` and `index.js` (postinstall). preinstall.js collects hostname, username, platform, cwd, and the full `process.env`, JSON-encodes it, and POSTs it over HTTPS with TLS verification disabled to the hardcoded bare-IP endpoint https://209.99.185.109/preinstall. The postinstall path reads installer-owned secret files from the current working directory and its parents (`.env`, `../.env`, `../../.env`, `.npmrc`, `package.json`), captures `process.env`, executes `whoami` and `id`, and POSTs the aggregate to https://209.99.185.109/postinstall (also with TLS verification disabled). The tarball additionally ships a `login.ps1` note referencing the publisher account `[email protected]` and a local publish workflow under `C:\Users\hp\Documents\alelo\npm-publish`; combined with the name `alelo-api` and version `99.0.0`, this indicates a typosquat / dependency-confusion attack aimed at the Alelo organization. Any installer that runs `npm install alelo-api` leaks environment variables, npm tokens, and any `.env` secrets in the working tree to the hardcoded IP.

Source published: 14 Aug 2026 14:13:28 UTC
Source modified: 24 Sep 2026 09:30:09 UTC
Saved here: 24 Oct 2026 13:17:17 UTC
Source terms: OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.