LWA-2026-11366 confirmed malware
commander-lib@1.0.0
Malicious code in commander-lib (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1105 · Ingress Tool TransferT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
The postinstall hook (scripts/postinstall.js) beacons host platform data via HTTP POST to 193[.]70[.]34[.]101:20099/vote. On Windows and WSL it XOR-decodes a hardcoded URL, downloads a second-stage binary to the temp directory as main.exe, and launches it as a detached background process; on WSL it executes a bridge command via the shell. The package is a combosquat of the commander CLI with no functional content.
- analyzed by
- Leitwacht
- first seen
- Aug 16, 2026, 02:50 AM
- analyzed
- Aug 16, 2026, 02:55 AM
Related advisories
- lodahs-cli@1.0.0
- commandor-core@1.0.0
- lodsh-cli@1.0.0
- lodhash-cli@1.0.0
- chalk-core@1.0.0
- comander-cli@1.0.0
- comand@1.0.0
- testingsmthb1g@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.