Malicious code in commandor-core (npm)

The npm package commandor-core version 1.0.0 contained malicious code embedded in its postinstall script (scripts/postinstall.js). The script uses XOR obfuscation with the key 'stf2026' to decode byte arrays that reveal a download URL pointing to giphub.com (a typosquat of github.com).\n\nOn Windows systems, the postinstall script fetches main.exe from https://giphub.com/bebraz1/PzM50V1AKG0rVlH/releases/download/null/main.exe into the %TEMP% directory and executes it. On WSL systems, it decodes and invokes a PowerShell bridge command to execute the fetched binary on the Windows host.\n\nAdditionally, the postinstall script unconditionally sends a POST request containing host platform information to http://193.70.34.101:20099/vote over plain HTTP. The IP address is obfuscated as a four-element array to evade literal-IP detection.\n\nThe package's main entry point (index.js) is empty, providing no legitimate library functionality. The sole purpose of installing commandor-core is to beacon the host and drop a malicious Windows executable. The incident was identified and credited to the OpenSSF malicious-packages repository.