comander-cli is a malicious npm package designed as a typosquat of the popular 'commander' package. Its index.js exports an empty object, providing no legitimate functionality. Instead, all malicious behavior occurs in a postinstall.js script that runs automatically during npm install. This script XOR-decodes obfuscated byte arrays with a hardcoded key to reconstruct a remote URL and Windows shell commands. It downloads a Windows executable to the %TEMP% directory and executes it detached and hidden. On Linux hosts running under WSL, it constructs an obfuscated command to execute the payload on the Windows host, bypassing the WSL boundary. The script also sends a JSON beacon via plain HTTP to a hardcoded IP address, using split-array IP construction to evade detection. These behaviors indicate deliberate obfuscation, typosquatting, and execution of attacker-supplied binaries at install time.

The malicious package can execute arbitrary code on Windows systems by downloading and running a hidden executable. It can also infect Windows hosts from Linux environments running under WSL by escaping the subsystem boundary. The package's beaconing to a remote IP may facilitate command and control or data exfiltration. This poses a significant risk of system compromise, persistence, and potential further malicious activity.

No official patch or remediation is indicated. Users should avoid installing the comander-cli package, especially since it is a typosquat of the legitimate 'commander' package. Verify package names carefully before installation. Remove any installations of comander-cli and scan affected systems for the downloaded payload and related artifacts. Monitor for suspicious network activity to the indicated IP address. Patch status is not yet confirmed — check vendor advisories or npm security notices for updates.