comand@1.0.0

Analysis

The postinstall hook (scripts/postinstall.js) beacons host platform metadata to 193[.]70[.]34[.]101:20099 via HTTP POST to /vote, and on Windows/WSL hosts downloads a native binary from hxxps://github[.]com/beabraz1/qPzM50V1AKG0rVlH/releases/download/null/main[.]exe into the temp directory as main.exe and executes it detached (backgrounded, hidden window). On WSL it runs a decoded bridge command via exec() to install the same addon. The binary URL is XOR-obfuscated in the script. The package performs host fingerprinting (WSL detection via /proc/version and kernel osrelease) before beaconing.