commandor-core

{"modified":"2026-08-18T23:58:12Z","published":"2026-08-18T23:58:12Z","schema_version":"1.7.4","id":"MAL-2026-14173","summary":"Malicious code in commandor-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3532b684cf99d23e6ab89c60fef9f2af5b1bfe36f4d793fcaf6bcf3f718903ab)\nThe postinstall script in commandor-core@1.0.0 (scripts/postinstall.js) contains XOR-obfuscated byte arrays that decode at runtime (unpackSegment with key 'stf2026') to a download URL at giphub.com — a typosquat of github.com — pointing at https://giphub.com/bebraz1/PzM50V1AKG0rVlH/releases/download/null/main.exe. On Windows the script fetches main.exe into %TEMP% and spawns it detached; on WSL it decodes and invokes a PowerShell bridge command to execute the fetched binary on the Windows host. The same postinstall unconditionally POSTs a JSON body describing the host platform to a hardcoded bare-IP endpoint at http://193.70.34.101:20099/vote (assembled from a four-element array to defeat literal-IP scans) over plain HTTP. The main entry index.js is empty; the package provides no library functionality, and the sole effect of `npm install commandor-core` is beaconing the host and dropping and executing an attacker-controlled Windows executable.\n","affected":[{"package":{"ecosystem":"npm","name":"commandor-core"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/postinstall.js","sha256":"4f512d415af57f24a4bddc03c85da557c1b8c78ad054cadca3a9b73e4442b034","tlsh":"17d13fc61ef59035874bf96884cf9d13b2a6c207330e4a65fb8f42107f5792c85a69d6"}],"package_integrity":[{"filename":"commandor-core-1.0.0.tgz","hashes":{"sha1":"c0e0ed6c21a3ee41da28578a7639dd90ff7f64cf","sha512_sri":"sha512-eE14osp4ygQ5yf9VS9E9JBDUkGCBwk2YaiRbw1FoTOtHe4/Ld+1omZbbGyboo2b/FZfwgyUTahiMxCm+TaWHGw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/commandor-core/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018243","import_time":"2026-08-19T00:21:12.403369384Z","modified_time":"2026-08-18T23:58:12Z","sha256":"3532b684cf99d23e6ab89c60fef9f2af5b1bfe36f4d793fcaf6bcf3f718903ab","source":"amazon-inspector","versions":["1.0.0"]}]}}