The commandor-cli npm package version 1.0.0 includes a postinstall script that performs malicious actions. It XOR-decodes a URL pointing to a GitHub repository hosting a binary executable, downloads this binary to the %TEMP% directory as main.exe, and executes it in a detached process. For users running WSL, the script further decodes a PowerShell command that downloads and executes the same binary on the Windows host, thereby compromising both Linux and Windows environments. The script also constructs an IPv4 address from an array and sends a JSON beacon containing platform details to http://193.70.34.101:20099/vote via plain HTTP. The use of XOR encoding for URLs and commands indicates an attempt to evade detection. The binary lacks any hash or signature verification, increasing the risk of arbitrary code execution. The source repository is unrelated to any legitimate publisher, indicating a supply chain compromise or malicious package upload.

This malicious package can lead to arbitrary code execution on the host system during installation, affecting both Linux and Windows environments (via WSL). The execution of an unsigned binary from an untrusted source can result in system compromise, data theft, or further malware deployment. The beaconing to a remote IP address over unencrypted HTTP may expose system information to an attacker and facilitate command and control activities. The obfuscation techniques used hinder detection and analysis.

Users should immediately uninstall commandor-cli version 1.0.0 and avoid installing this package from untrusted sources. Since no patch or official fix is indicated, users should consider this version compromised and avoid using it. Monitor for any unexpected binaries named main.exe in temporary directories and investigate any suspicious network traffic to IP 193.70.34.101 on port 20099. Use trusted package registries and verify package authenticity before installation.