[email protected] is a malicious typosquat of the legitimate 'commander' npm package. Its postinstall.js script automatically executes on installation, performing two hostile actions: it sends the installer's platform label as JSON to a hardcoded IP address (193.70.34.101:20099) to a command-and-control server, and it XOR-decodes an attacker-controlled GitHub URL to download an executable payload to the Windows temporary directory. This payload is then executed in a hidden, detached process on Windows. On WSL or virtualized Linux environments, it uses an XOR-decoded PowerShell bridge command to execute the same payload on the Windows host, effectively escaping the Linux sandbox. The package contains no native addon code, confirming it is solely a dropper. The use of XOR encoding conceals the attacker's infrastructure and commands.

Installation of [email protected] results in unauthorized data exfiltration (platform information) to an attacker-controlled server and execution of a potentially malicious executable on the victim's Windows system. The payload execution occurs stealthily, with hidden windows and detached processes, increasing the risk of persistent compromise. The ability to escape WSL sandboxing on Linux hosts further broadens the attack surface. This can lead to system compromise, unauthorized remote control, and further malware deployment.

This package is malicious and should be removed immediately if installed. Avoid installing packages with suspicious or typo-squatted names. Use trusted sources and verify package authenticity before installation. There is no official patch or fix for this malicious package; remediation involves uninstalling the package and scanning affected systems for the downloaded payload and any persistence mechanisms. Monitor for network connections to the hardcoded IP address and block it at network perimeter controls. Consider using package integrity verification tools and npm security advisories to prevent installation of such malicious packages.