commandor-core @1.0.0

Summary

The postinstall script in commandor-core@1.0.0 (scripts/postinstall.js) contains XOR-obfuscated byte arrays that decode at runtime (unpackSegment with key 'stf2026') to a download URL at giphub.com — a typosquat of github.com — pointing at https://giphub.com/bebraz1/PzM50V1AKG0rVlH/releases/download/null/main.exe. On Windows the script fetches main.exe into %TEMP% and spawns it detached; on WSL it decodes and invokes a PowerShell bridge command to execute the fetched binary on the Windows host. The same postinstall unconditionally POSTs a JSON body describing the host platform to a hardcoded bare-IP endpoint at http://193.70.34.101:20099/vote (assembled from a four-element array to defeat literal-IP scans) over plain HTTP. The main entry index.js is empty; the package provides no library functionality, and the sole effect of npm install commandor-core is beaconing the host and dropping and executing an attacker-controlled Windows executable.

Source: amazon-inspector (3532b684cf99d23e6ab89c60fef9f2af5b1bfe36f4d793fcaf6bcf3f718903ab)