commandor-lib

{"modified":"2026-08-19T03:42:52Z","published":"2026-08-19T03:42:52Z","schema_version":"1.7.4","id":"MAL-2026-14234","summary":"Malicious code in commandor-lib (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2e184348abf5c5ce61ee6c4e63189411a08755e57e95dac33c666adae7c6dc2d)\nThe package's scripts/postinstall.js runs automatically on npm install and imports child_process alongside http.request with multiple POST call sites (lines 13, 95, 194). This pattern in a lifecycle hook — spawning subprocesses and posting data to an external HTTP endpoint at install time — is consistent with installer-side reconnaissance and exfiltration to an author-controlled destination and does not correspond to any documented purpose of a generically named library package.\n","affected":[{"package":{"ecosystem":"npm","name":"commandor-lib"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/postinstall.js","sha256":"1edaf0ae232e5ef6665ae3c08bff2132da50dc6a72db2d0dc1c289fff622f63d","tlsh":"31d13fc61ef5a036874bf96884cf9d13b2a6c207330d4a65fb8f42107f5792c85a69d6"}],"package_integrity":[{"filename":"commandor-lib-1.0.0.tgz","hashes":{"sha1":"042830b450784aef86e318e5d8920c2e818445cc","sha512_sri":"sha512-t4ubzf5RMWt5Bf1K3El4KFyIVgV9CLOUZbc85e3kC5fwBitEJTHsqqVGaNFY2hbkABOKJp03rU3UVqf86Wa6qA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/commandor-lib/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018334","import_time":"2026-08-19T03:49:30.81864293Z","modified_time":"2026-08-19T03:42:52Z","sha256":"2e184348abf5c5ce61ee6c4e63189411a08755e57e95dac33c666adae7c6dc2d","source":"amazon-inspector","versions":["1.0.0"]}]}}