commandor-lib @1.0.0

Summary

The package's scripts/postinstall.js runs automatically on npm install and imports child_process alongside http.request with multiple POST call sites (lines 13, 95, 194). This pattern in a lifecycle hook — spawning subprocesses and posting data to an external HTTP endpoint at install time — is consistent with installer-side reconnaissance and exfiltration to an author-controlled destination and does not correspond to any documented purpose of a generically named library package.

Source: amazon-inspector (2e184348abf5c5ce61ee6c4e63189411a08755e57e95dac33c666adae7c6dc2d)