MAL-2026-14174

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/commandorjs/MAL-2026-14174.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14174
Published
2026-08-18T23:56:56Z
Modified
2026-08-19T00:30:14.604235205Z
Summary
Malicious code in commandorjs (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bdd905d058d1f6d1d32c380316559a38d52610dc95295528c85ccf990df9b51b)

commandorjs@1.0.0 is a dropper disguised as an npm library. Its index.js exports an empty object; the only functional code is scripts/postinstall.js, which runs automatically on npm install. The postinstall script POSTs a JSON payload with platform/arch/node info to a hardcoded plain-HTTP endpoint at 193.70.34.101:20099/vote (host assembled from a split integer array). It then XOR-decodes obfuscated blobs (ADDONENC, BRIDGELAUNCHERENC, BRIDGESCRIPTPREENC, BRIDGESCRIPTPOST_ENC) using the 7-byte key 'stf2026' to reconstruct a github.com download URL and shell launcher commands. On Windows it downloads the decoded binary to %TEMP%/main.exe and launches it detached; on WSL/virtualized Linux it executes a decoded PowerShell-style bridge command to run the Windows payload on the host. URL and shell-command obfuscation, bare-IP plain-HTTP telemetry, write-to-temp with detached exec, and a WSL-to-Windows-host bridge together form an install-time remote-code-execution dropper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T00:21:11.630713223Z",
            "sha256": "bdd905d058d1f6d1d32c380316559a38d52610dc95295528c85ccf990df9b51b",
            "modified_time": "2026-08-18T23:56:56Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018235",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / commandorjs

Package

Name
commandorjs
View open source insights on deps.dev
Purl
pkg:npm/commandorjs

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/commandorjs/MAL-2026-14174.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "777c4e70080eed1c90b8d542c12e57fb18392c12f61328bc84553f125b4a3a4d",
            "tlsh": "12d13fc61ef59035874bf96884cf9d13b2a6c207330e4a65ff8f42107f5792c85a69ea",
            "path": "scripts/postinstall.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "commandorjs-1.0.0.tgz",
            "hashes": {
                "sha1": "71e332f6ffa9e4a396156ac8997ef9a35a90ee8a",
                "sha512_sri": "sha512-KRlZNdtB1Qn6UfIxTW1kiqSDRv4oxiYZ7kkxKEGcY+ezgvPqjJADrsnM7kwSwo5A4k3PjzkiiwGOmgHtTcYLOA=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]