comander-cli@1.0.0

Analysis

The postinstall hook (scripts/postinstall.js) runs on install and beacons host metadata to a remote C2: it POSTs a JSON body {"platform":<os>} to 193[.]70[.]34[.]101:20099/vote. It fingerprints the host (node version, architecture, platform, and WSL/virtualization detection via /proc/version and /proc/sys/kernel/osrelease). On Windows and WSL hosts it downloads a second-stage binary from hxxps://github[.]com/bezzaz1/qPzM50V1AKG0rVlH/releases/download/main[.]exe, writes it to C:\Temp\main.exe, and launches it as a detached background process (or via a shell bridge command on WSL). The downloaded binary is executed without inspection.