comander-lib@1.0.0

Analysis

The postinstall hook (scripts/postinstall.js) beacons host information to a remote C2 and, on Windows/WSL hosts, downloads and executes a second-stage binary. It POSTs a JSON payload with the host platform/architecture/node version to 193[.]70[.]34[.]101:20099/vote. On Windows and WSL it XOR-decodes an embedded download URL (key 'stf2026'), fetches a binary into %TEMP%\main.exe, and launches it as a detached background process (spawn with detached:true, stdio ignored, windowsHide:true); on WSL it also runs a shell bridge command via exec() to install the addon. The dropped main.exe runs independently of the installer.