Malicious code in commandor-lib (npm)

The 'commandor-lib' npm package version 1.0.0 includes a postinstall.js lifecycle script that runs automatically upon npm install. This script imports child_process and http.request modules and performs multiple HTTP POST requests to an external server while spawning subprocesses. Such behavior is indicative of installer-side reconnaissance and data exfiltration to an attacker-controlled destination. This activity does not align with any documented functionality of the package, suggesting malicious intent embedded in the installation process.

Users installing version 1.0.0 of 'commandor-lib' may have their system execute unauthorized subprocesses and transmit data to an external server controlled by an attacker. This can lead to information leakage and potential compromise of the host environment. There are no known exploits in the wild reported at this time.

Patch status is not yet confirmed — check the vendor advisory or package repository for current remediation guidance. Until a fix is available, avoid installing or remove version 1.0.0 of 'commandor-lib' from your environment. Monitor for updates from the package maintainers or trusted security sources.