If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (d98bac664d9feb9d1d326fb6d724b9a62631267258ae81e69c5b4c0a057ba0f6)
The package runs malicious lifecycle scripts on npm install. preinstall.js collects hostname, username, platform, cwd, and the entire process.env, then POSTs the JSON payload over HTTPS with certificate verification disabled to https://209.99.185.109/preinstall. index.js (postinstall) reads.env,.npmrc, package.json,../.env, and../../.env from the installer's tree, executes `whoami` and `id`, dumps process.env, and POSTs the collected data to https://209.99.185.109/postinstall over HTTPS with certificate verification disabled. The destination is a bare IP unrelated to any declared publisher;.npmrc typically contains npm auth tokens and.env files hold application secrets, so installation of this package results in exfiltration of credentials, tokens, and host identity from the installer's machine. A shipped login.ps1 references npm account oxy12@proton.me as the publishing identity. The package name resembles an internal/branded package (Alelo), consistent with a dependency-confusion lure.