MAL-2026-14173

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (3532b684cf99d23e6ab89c60fef9f2af5b1bfe36f4d793fcaf6bcf3f718903ab) The postinstall script in commandor-core@1.0.0 (scripts/postinstall.js) contains XOR-obfuscated byte arrays that decode at runtime (unpackSegment with key 'stf2026') to a download URL at giphub.com — a typosquat of github.com — pointing at https://giphub.com/bebraz1/PzM50V1AKG0rVlH/releases/download/null/main.exe. On Windows the script fetches main.exe into %TEMP% and spawns it detached; on WSL it decodes and invokes a PowerShell bridge command to execute the fetched binary on the Windows host. The same postinstall unconditionally POSTs a JSON body describing the host platform to a hardcoded bare-IP endpoint at http://193.70.34.101:20099/vote (assembled from a four-element array to defeat literal-IP scans) over plain HTTP. The main entry index.js is empty; the package provides no library functionality, and the sole effect of `npm install commandor-core` is beaconing the host and dropping and executing an attacker-controlled Windows executable.