MAL-2026-14173
Dashboard / Malicious Package / MAL-2026-14173
MAL-2026-14173
Summary: Malicious code in commandor-core (npm)
Details: Source: amazon-inspector (3532b684cf99d23e6ab89c60fef9f2af5b1bfe36f4d793fcaf6bcf3f718903ab) The postinstall script in [email protected] (scripts/postinstall.js) contains XOR-obfuscated byte arrays that decode at runtime (unpackSegment with key 'stf2026') to a download URL at giphub.com — a typosquat of github.com — pointing at https://giphub.com/bebraz1/PzM50V1AKG0rVlH/releases/download/null/main.exe. On Windows the script fetches main.exe into %TEMP% and spawns it detached; on WSL it decodes and invokes a PowerShell bridge command to execute the fetched binary on the Windows host. The same postinstall unconditionally POSTs a JSON body describing the host platform to a hardcoded bare-IP endpoint at http://193.70.34.101:20099/vote (assembled from a four-element array to defeat literal-IP scans) over plain HTTP. The main entry index.js is empty; the package provides no library functionality, and the sole effect of `npm install commandor-core` is beaconing the host and dropping and executing an attacker-controlled Windows executable.
Affected packages
Package
Name: commandor-core
Purl: pkg:npm/commandor-core
Affected ranges
Type: N/A
Events:
