{"answers":{"affected":"1 open source package ship an affected version, including comander-cli.","exploited":"There is no known exploitation of MAL-2026-14170 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14170 is a malicious package in comander-cli, published on 18 Aug 2026."},"fix_prompt":"MAL-2026-14170 is a malicious package: comander-cli (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14170/ (Markdown: https://insights.sbomify.com/MAL-2026-14170/index.md)","id":"MAL-2026-14170","markdown":"https://insights.sbomify.com/MAL-2026-14170/index.md","name":"MAL-2026-14170","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"comander-cli is a typosquat of the popular 'commander' package whose index.js exports an empty object, providing no advertised functionality. All behavior is in scripts/postinstall.js, which runs automatically on npm install. The script XOR-decodes obfuscated byte arrays with the hardcoded key 'stf2026' to reconstruct a remote download URL and Windows shell/powershell bridge commands, fetches a Windows executable, writes it to %TEMP%\\main.exe, and launches it detached with stdio ignored and windowsHide. On Linux hosts running under WSL (detected via WSL_DISTRO_NAME, WSLENV, and /proc/version containing 'microsoft'), the script assembles an obfuscated bridge command and passes it to child_process.exec to install and execute the payload on the underlying Windows host, escaping the WSL boundary. The postinstall also POSTs a JSON install beacon over plain HTTP to the hardcoded bare IP 193.70.34.101:20099/vote, with the host reconstructed from a split string array (['193','70','34','101'].join('.')) to evade literal-IP pattern matching. Obfuscated URLs, split-array IP construction, empty library surface, typosquat naming, and install-time detached execution of an attacker-supplied binary are all present.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in comander-cli (npm)","id":"MAL-2026-14170","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"comander-cli","purl":"pkg:npm/comander-cli","source":"MAL-2026-14170"}],"products":null,"published":"2026-08-18","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14170/"}