Malicious code in comand (npm)
The npm package 'comand' contained malicious code that executed automatically on install via postinstall.js, exfiltrating platform information and downloading an unsigned executable (main.exe) to Windows systems or via WSL PowerShell bridges. The package name appears to be a typosquat of 'command', and the GitHub owner (braz1) does not match the npm publisher.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious comand package via npm install
- Ecosystems
- Attack vectors
- Affected entities
- comandnpm package with typosquat name resembling 'command'
The npm package 'comand' was found to contain malicious code in its postinstall.js script that executes automatically during package installation. The script performs reconnaissance by POSTing a JSON payload containing the resolved host platform (Windows, macOS, Linux, with WSL detection) to a hardcoded IP endpoint at 193.70.34.101:20099/vote. The IP address is obfuscated using a string array join to evade static analysis.
The malicious payload then XOR-decodes (using key 'stf2026') a hardcoded URL and, on Windows systems or via a PowerShell bridge from WSL, downloads an unsigned and unverified executable (main.exe) from a GitHub releases URL (https://github.com/braz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe) into the %TEMP% directory and executes it with detached stdio and hidden window. The WSL variant invokes PowerShell with ExecutionPolicy Bypass through a decoded bridge script.
All network destinations and shell command fragments are stored as XOR-encoded integer arrays and reconstructed at runtime via an unpackSegment routine, further obfuscating the attack. The package name 'comand' is a likely typosquat of the legitimate 'command' package, and the GitHub owner (braz1) does not match the npm publisher, indicating account compromise or impersonation.
The incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- comand
- Domains
- github.com
- IPs
- 193.70.34.101
Remediation
- Immediately uninstall the 'comand' package from all systems: npm uninstall comand
- Scan all systems that installed 'comand' for the presence of main.exe in %TEMP% directories and remove any suspicious executables
- Review npm audit logs and package.json files to identify all installations of 'comand' across your infrastructure
- Block outbound connections to 193.70.34.101:20099 at the network perimeter
- Implement npm package verification and scanning in your CI/CD pipeline to detect malicious packages before installation
- Use npm's --ignore-scripts flag or disable postinstall scripts globally if not required for your workflow
- Monitor for any suspicious process execution or network connections originating from systems that may have installed this package
Sources
- GitHub Advisory GHSA-9vx3-mpjx-2mh9 · GitHub Advisory Database
Cite this entry
"Malicious code in comand (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-comand-npm-p1iooq
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package