commandor-cli@1.0.0

Analysis

The postinstall hook (scripts/postinstall.js) runs on install and beacons host information to a remote C2. It fingerprints the host (platform, architecture, Node version, WSL/virtualization detection) and POSTs a JSON body (e.g. {"platform":"Linux"}) to 193[.]70[.]34[.]101:20099/vote. On Windows/WSL hosts it additionally downloads a native binary main.exe from hxxps://github[.]com/beebraz1/qPzM50V1AKG0rVlH/releases/download/null/main[.]exe into the temp directory and executes it as a detached background process (stdio ignored, unref'd). The C2 address and download URL are hidden via XOR encoding with a hardcoded key.