MAL-2026-14174
Dashboard / Malicious Package / MAL-2026-14174
MAL-2026-14174
Summary: Malicious code in commandorjs (npm)
Details: Source: amazon-inspector (bdd905d058d1f6d1d32c380316559a38d52610dc95295528c85ccf990df9b51b) [email protected] is a dropper disguised as an npm library. Its index.js exports an empty object; the only functional code is scripts/postinstall.js, which runs automatically on npm install. The postinstall script POSTs a JSON payload with platform/arch/node info to a hardcoded plain-HTTP endpoint at 193.70.34.101:20099/vote (host assembled from a split integer array). It then XOR-decodes obfuscated blobs (ADDON_ENC, BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) using the 7-byte key 'stf2026' to reconstruct a github.com download URL and shell launcher commands. On Windows it downloads the decoded binary to %TEMP%/main.exe and launches it detached; on WSL/virtualized Linux it executes a decoded PowerShell-style bridge command to run the Windows payload on the host. URL and shell-command obfuscation, bare-IP plain-HTTP telemetry, write-to-temp with detached exec, and a WSL-to-Windows-host bridge together form an install-time remote-code-execution dropper.
Affected packages
Package
Name: commandorjs
Purl: pkg:npm/commandorjs
Affected ranges
Type: N/A
Events:
