comanderjs@1.0.0

Analysis

The postinstall hook (scripts/postinstall.js) runs on install. It fingerprints the host (platform, architecture, Node version, WSL/virtualization detection via /proc/version) and POSTs the platform label as JSON to 193[.]70[.]34[.]101:20099/vote. On Windows or WSL hosts it then downloads a second-stage binary from hxxps://github[.]com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main[.]exe into the temp directory and executes it as a detached background process (spawn with detached:true, stdio ignored, unref'd), or runs a bridge command via exec. The C2 endpoint is 193[.]70[.]34[.]101:20099.