commandor-lib@1.0.0

Analysis

The postinstall hook (scripts/postinstall.js) beacons the host platform to a remote C2 at 193[.]70[.]34[.]101:20099 via HTTP POST to /vote with a JSON body containing the platform label. It then XOR-decodes (key 'stf2026') an embedded URL for a second-stage binary, downloads it to the temp directory as main.exe, and spawns it detached with windowsHide:true so it runs in the background. On Windows/WSL hosts it instead executes a shell bridge command that downloads and runs the same binary. The package has no functional purpose (empty description, trivial index.js); its only behaviour is the install-time beacon and binary dropper.