Malicious code in comander-lib (npm)
comander-lib@1.0.0 is a typosquat of the legitimate `commander` package containing malicious code. The package's postinstall script exfiltrates system information to a C2 server and downloads and executes a Windows payload, with capability to escape WSL/Linux sandboxes via PowerShell.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed comander-lib@1.0.0 via npm
- Ecosystems
- Attack vectors
- Affected entities
- comander-lib · 1.0.0
comander-lib@1.0.0 is a typosquatting attack targeting developers who may mistype the popular commander npm package. The malicious package contains an empty index.js with no legitimate functionality, serving purely as a dropper.
Upon installation, the package's scripts/postinstall.js automatically executes two hostile actions. First, it exfiltrates the installer's platform information via HTTP POST to a hardcoded C2 server at 193.70.34.101:20099/vote. The IP address is obfuscated using array-join to evade static analysis. Second, it XOR-decodes (key stf2026) an attacker-controlled GitHub URL, downloads an executable to %TEMP%/main.exe, and executes it with Windows-specific hiding flags.
The package includes additional sandbox-escape capability: on WSL or virtualized Linux environments, it XOR-decodes a PowerShell bridge command and invokes it to execute the same payload on the underlying Windows host. All malicious URLs, commands, and script fragments are stored as XOR-encoded byte arrays at runtime to conceal the attack surface.
The package falsely advertises itself as a native-addon mirror but ships no addon code, confirming it is a pure malware dropper.
Indicators of compromise
- Packages
- comander-lib
- IPs
- 193.70.34.101
Remediation
- Immediately uninstall comander-lib from all systems
- Audit npm install logs to identify all systems that installed comander-lib@1.0.0
- Scan affected systems for the presence of %TEMP%/main.exe or related artifacts
- Review network logs for connections to 193.70.34.101:20099
- If Windows systems were compromised, perform full malware scans and consider forensic analysis
- Use the correct package name `commander` (not `comander-lib`) for future installations
- Enable npm package verification and consider using npm audit to detect typosquatting attempts
- Implement allowlist-based package management policies to prevent installation of unexpected packages
Sources
- GitHub Advisory GHSA-p4mx-f4jf-w9fx · GitHub Advisory Database
Cite this entry
"Malicious code in comander-lib (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-comander-lib-npm-1beyib
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package