Malicious code in commandorjs (npm)

commandorjs@1.0.0 is a malicious npm package designed to act as a dropper. The package exports an empty object in its main index.js, but contains functional malicious code in scripts/postinstall.js that executes automatically during npm install.\n\nThe postinstall script performs reconnaissance by POSTing a JSON payload containing platform, architecture, and Node.js version information to a hardcoded plain-HTTP endpoint at 193.70.34.101:20099/vote. It then XOR-decodes obfuscated binary blobs using the 7-byte key 'stf2026' to reconstruct a GitHub download URL and shell launcher commands.\n\nOn Windows systems, the decoded binary is downloaded to %TEMP%/main.exe and executed with detached process creation. On WSL or virtualized Linux environments, the package executes a decoded PowerShell-style bridge command to run the Windows payload on the host system. The combination of install-time execution, obfuscation, bare-IP telemetry, and cross-platform payload delivery makes this a sophisticated remote-code-execution dropper.\n\nThe package was identified and credited to the OpenSSF malicious-packages project.", <parameter name="remediation">["Immediately uninstall commandorjs from all systems where it was installed", "Audit npm install logs and dependency trees to identify all affected projects and installations", "Assume any system that installed commandorjs@1.0.0 may be compromised; perform forensic analysis for signs of payload execution", "Review outbound network connections from affected systems for communication to 193.70.34.101:20099", "Regenerate any credentials or secrets that may have been exposed on affected systems", "Update npm to the latest version and clear the npm cache", "Use npm audit to check for other malicious packages in your dependency tree"]