Malicious code in comander-cli (npm)

comander-cli is a typosquat of the popular 'commander' npm package designed to deceive developers into installing it instead of the legitimate library. The package exports an empty object, providing no advertised functionality.

All malicious behavior is contained in scripts/postinstall.js, which executes automatically during npm install. The script XOR-decodes obfuscated byte arrays using the hardcoded key 'stf2026' to reconstruct a remote download URL and Windows shell/powershell commands. It then fetches a Windows executable, writes it to %TEMP%\main.exe, and launches it with detached stdio and hidden window.

On Linux hosts running under WSL, the script detects the environment via WSL_DISTRO_NAME, WSLENV, and /proc/version checks, then assembles an obfuscated bridge command to install and execute the payload on the underlying Windows host, escaping the WSL boundary. Additionally, the postinstall script POSTs a JSON install beacon over plain HTTP to 193.70.34.101:20099/vote, with the IP address reconstructed from a split string array to evade pattern matching.

The attack combines multiple evasion techniques: obfuscated URLs, split-array IP construction, empty library surface, typosquat naming, and install-time execution of attacker-supplied binaries.