MAL-2026-14174
Malicious code in commandorjs (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (bdd905d058d1f6d1d32c380316559a38d52610dc95295528c85ccf990df9b51b) commandorjs@1.0.0 is a dropper disguised as an npm library. Its index.js exports an empty object; the only functional code is scripts/postinstall.js, which runs automatically on npm install. The postinstall script POSTs a JSON payload with platform/arch/node info to a hardcoded plain-HTTP endpoint at 193.70.34.101:20099/vote (host assembled from a split integer array). It then XOR-decodes obfuscated blobs (ADDON_ENC, BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) using the 7-byte key 'stf2026' to reconstruct a github.com download URL and shell launcher commands. On Windows it downloads the decoded binary to %TEMP%/main.exe and launches it detached; on WSL/virtualized Linux it executes a decoded PowerShell-style bridge command to run the Windows payload on the host. URL and shell-command obfuscation, bare-IP plain-HTTP telemetry, write-to-temp with detached exec, and a WSL-to-Windows-host bridge together form an install-time remote-code-execution dropper.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for commandorjs (npm). Pin to a known-safe version or switch to an alternative.