Malicious code in commandor-core (npm)

The postinstall script in commandor-core version 1.0.0 includes XOR-obfuscated byte arrays that decode at runtime to a download URL hosted on giphub.com, a typosquatted domain mimicking github.com. On Windows systems, the script downloads a binary named main.exe into the temporary directory and executes it detached. On Windows Subsystem for Linux (WSL), it uses a PowerShell bridge to execute the binary on the Windows host. Additionally, the script unconditionally sends a JSON payload describing the host platform to a hardcoded IP address (193.70.34.101) over plain HTTP. The package's main entry point is empty and it offers no legitimate library functionality, indicating its sole purpose is malicious.

Installation of [email protected] results in execution of attacker-controlled code on the host system, potentially leading to full compromise of Windows environments. The package also leaks host platform information to an attacker-controlled server over unencrypted HTTP, which could aid in further targeted attacks or reconnaissance.

Avoid installing [email protected] or any untrusted npm packages. Since no official patch or remediation is available, users should remove this package if installed and scan affected systems for the downloaded executable and any related persistence mechanisms. Monitor for network connections to suspicious IP addresses such as 193.70.34.101 and domains similar to github.com. Use trusted package sources and verify package integrity before installation.