Malicious code in commandor-cli (npm)
commandor-cli@1.0.0 on npm contains malicious postinstall script that downloads and executes a binary from an attacker-controlled GitHub repository. The script also beacons installation metadata to a command-and-control server and includes a PowerShell bridge to extend execution to Windows hosts on WSL systems.
- Disclosed
- Last updated
- Blast radius
- All systems that installed commandor-cli@1.0.0
- Ecosystems
- Attack vectors
- Affected entities
- commandor-cli · 1.0.0
The postinstall script in commandor-cli@1.0.0 (scripts/postinstall.js) contains obfuscated malicious code that XOR-decodes a hardcoded URL using the key 'stf2026'. The decoded URL resolves to https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe, from which the script downloads an executable binary, writes it to %TEMP%\main.exe, and executes it with detached process spawning.
The malicious script includes a companion XOR-encoded PowerShell command that, when decoded, pipes the same malicious URL through to execute the binary on the Windows host, extending the attack surface to non-Linux WSL installers. Additionally, the script assembles a bare IPv4 address (193.70.34.101) from a split array and POSTs a JSON beacon carrying platform identification to http://193.70.34.101:20099/vote over unencrypted HTTP, enabling command-and-control communication and installation tracking.
The attack employs multiple obfuscation techniques: the payload URL and PowerShell bridge command are stored as XOR-encoded byte arrays rather than plaintext, the binary is downloaded without hash or signature verification, and the download source is a personal GitHub repository unrelated to any documented publisher. This incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- commandor-cli
- Domains
- github.com/bebraz1/qPzM50V1AKG0rVlH
- IPs
- 193.70.34.101
Remediation
- Immediately uninstall commandor-cli@1.0.0 from all systems
- Audit systems that installed the affected version for execution of main.exe or related binaries
- Block outbound connections to 193.70.34.101:20099
- Review npm package dependencies for commandor-cli and remove if present
- Monitor for suspicious process execution and network beaconing from affected systems
- Consider using npm audit or similar tools to detect the malicious package in dependency trees
Sources
- GitHub Advisory GHSA-29fm-w888-2mc8 · GitHub Advisory Database
Cite this entry
"Malicious code in commandor-cli (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-commandor-cli-npm-1o2uox
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit