MAL-2026-14170

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/comander-cli/MAL-2026-14170.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14170
Published
2026-08-18T23:56:29Z
Modified
2026-08-19T00:30:17.864857740Z
Summary
Malicious code in comander-cli (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8296169da90107eec2a24127137eacf4a47dfca0c780111705aa542c3159d626)

comander-cli is a typosquat of the popular 'commander' package whose index.js exports an empty object, providing no advertised functionality. All behavior is in scripts/postinstall.js, which runs automatically on npm install. The script XOR-decodes obfuscated byte arrays with the hardcoded key 'stf2026' to reconstruct a remote download URL and Windows shell/powershell bridge commands, fetches a Windows executable, writes it to %TEMP%\main.exe, and launches it detached with stdio ignored and windowsHide. On Linux hosts running under WSL (detected via WSLDISTRONAME, WSLENV, and /proc/version containing 'microsoft'), the script assembles an obfuscated bridge command and passes it to child_process.exec to install and execute the payload on the underlying Windows host, escaping the WSL boundary. The postinstall also POSTs a JSON install beacon over plain HTTP to the hardcoded bare IP 193.70.34.101:20099/vote, with the host reconstructed from a split string array (['193','70','34','101'].join('.')) to evade literal-IP pattern matching. Obfuscated URLs, split-array IP construction, empty library surface, typosquat naming, and install-time detached execution of an attacker-supplied binary are all present.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T00:21:11.322661059Z",
            "sha256": "8296169da90107eec2a24127137eacf4a47dfca0c780111705aa542c3159d626",
            "modified_time": "2026-08-18T23:56:29Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018232",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / comander-cli

Package

Name
comander-cli
View open source insights on deps.dev
Purl
pkg:npm/comander-cli

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/comander-cli/MAL-2026-14170.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "6edbc90bf0862e576f4bbff7f5d8fa0c0ad65698a9d3485074dc6bc7b946d57d",
            "tlsh": "c2d13fca1ef59035874bf96884cf9d13b2a6c207320e4a65ff8f42107f5793c85a69e9",
            "path": "scripts/postinstall.js"
        },
        {
            "sha256": "ac13991093efce1485ecbfa7fa9fa75895e04161fd015d3699fbd07179e829ec",
            "path": "index.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "comander-cli-1.0.0.tgz",
            "hashes": {
                "sha1": "9afbcb3faa5a097d61b6b16d31e461e7d2148f0a",
                "sha512_sri": "sha512-l952YIX3KETaXi0d3d+eKNkzAHNOGj/YqBfqgvb8Cb8GTzt2qBLgAZfGBmTrl0wuaALfj7pUQno9yUZwStU+CA=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]