Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in commandor-cli (npm)

commandor-cli@1.0.0 on npm contains malicious postinstall script that downloads and executes a binary from an attacker-controlled GitHub repository. The script also beacons installation metadata to a command-and-control server and includes a PowerShell bridge to extend execution to Windows hosts on WSL systems.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
All systems that installed commandor-cli@1.0.0
Ecosystems
Attack vectors
Affected entities
  • commandor-cli · 1.0.0

The postinstall script in commandor-cli@1.0.0 (scripts/postinstall.js) contains obfuscated malicious code that XOR-decodes a hardcoded URL using the key 'stf2026'. The decoded URL resolves to https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe, from which the script downloads an executable binary, writes it to %TEMP%\main.exe, and executes it with detached process spawning.

The malicious script includes a companion XOR-encoded PowerShell command that, when decoded, pipes the same malicious URL through to execute the binary on the Windows host, extending the attack surface to non-Linux WSL installers. Additionally, the script assembles a bare IPv4 address (193.70.34.101) from a split array and POSTs a JSON beacon carrying platform identification to http://193.70.34.101:20099/vote over unencrypted HTTP, enabling command-and-control communication and installation tracking.

The attack employs multiple obfuscation techniques: the payload URL and PowerShell bridge command are stored as XOR-encoded byte arrays rather than plaintext, the binary is downloaded without hash or signature verification, and the download source is a personal GitHub repository unrelated to any documented publisher. This incident was identified and credited to the OpenSSF malicious-packages project.

Indicators of compromise

Packages
  • commandor-cli
Domains
  • github.com/bebraz1/qPzM50V1AKG0rVlH
IPs
  • 193.70.34.101

Remediation

  • Immediately uninstall commandor-cli@1.0.0 from all systems
  • Audit systems that installed the affected version for execution of main.exe or related binaries
  • Block outbound connections to 193.70.34.101:20099
  • Review npm package dependencies for commandor-cli and remove if present
  • Monitor for suspicious process execution and network beaconing from affected systems
  • Consider using npm audit or similar tools to detect the malicious package in dependency trees

Sources

  1. GitHub Advisory GHSA-29fm-w888-2mc8 · GitHub Advisory Database

Cite this entry

"Malicious code in commandor-cli (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-commandor-cli-npm-1o2uox

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

  1. resolvedcritical

    Malicious code in rust-testing-utils (npm)

    The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.

    npmCompromised packageMalicious commit
  2. resolvedcritical

    Malicious code in @syncraft-labs/core (npm)

    The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.

    npmCompromised packageMalicious commit
  3. resolvedcritical

    Malicious code in localize-translate (npm)

    The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.

    npmCompromised packageMalicious commit
  4. containedcritical

    Malicious code in mutex-plus (npm)

    The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.

    npmCompromised packageMalicious commit