{"answers":{"affected":"1 open source package ship an affected version, including comander-lib.","exploited":"There is no known exploitation of MAL-2026-14171 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14171 is a malicious package in comander-lib, published on 18 Aug 2026."},"fix_prompt":"MAL-2026-14171 is a malicious package: comander-lib (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14171/ (Markdown: https://insights.sbomify.com/MAL-2026-14171/index.md)","id":"MAL-2026-14171","markdown":"https://insights.sbomify.com/MAL-2026-14171/index.md","name":"MAL-2026-14171","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"comander-lib@1.0.0 is a typosquat of `commander` with an empty index.js and no native sources. Its scripts/postinstall.js runs automatically on `npm install` and performs two hostile actions. First, it POSTs the installer's platform label as JSON to a hardcoded bare-IP C2 at http://193.70.34.101:20099/vote, with the host built via array-join (`['193','70','34','101'].join('.')`) to hide the literal. Second, it XOR-decodes (key `stf2026`) an attacker-controlled github.com URL and fetches an executable to `%TEMP%/main.exe`, then spawns it detached with `windowsHide:true` on Windows. On WSL/virtualized Linux it XOR-decodes a PowerShell bridge command and invokes it to execute the same payload on the Windows host, escaping the Linux sandbox. Addon URL, PowerShell launcher, and script fragments are all stored as XOR-encoded byte arrays decoded at runtime, concealing the destination and command surface. The package advertises itself as a native-addon mirror but ships no addon code, confirming a pure dropper cover story.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in comander-lib (npm)","id":"MAL-2026-14171","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"comander-lib","purl":"pkg:npm/comander-lib","source":"MAL-2026-14171"}],"products":null,"published":"2026-08-18","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14171/"}