MAL-2026-14170 Malicious code in comander-cli (npm)

comander-cli is a typosquat of the popular 'commander' package whose index.js exports an empty object, providing no advertised functionality. All behavior is in scripts/postinstall.js, which runs automatically on npm install. The script XOR-decodes obfuscated byte arrays with the hardcoded key 'stf2026' to reconstruct a remote download URL and Windows shell/powershell bridge commands, fetches a Windows executable, writes it to %TEMP%\main.exe, and launches it detached with stdio ignored and windowsHide. On Linux hosts running under WSL (detected via WSL_DISTRO_NAME, WSLENV, and /proc/version containing 'microsoft'), the script assembles an obfuscated bridge command and passes it to child_process.exec to install and execute the payload on the underlying Windows host, escaping the WSL boundary. The postinstall also POSTs a JSON install beacon over plain HTTP to the hardcoded bare IP 193.70.34.101:20099/vote, with the host reconstructed from a split string array (['193','70','34','101'].join('.')) to evade literal-IP pattern matching. Obfuscated URLs, split-array IP construction, empty library surface, typosquat naming, and install-time detached execution of an attacker-supplied binary are all present.