# MAL-2026-14171: Malicious code in comander-lib (npm)


- **Type:** Malicious package
- **Package:** `comander-lib` (npm)
- **Published:** 18 Aug 2026

## What is MAL-2026-14171?

MAL-2026-14171 is a malicious package in comander-lib, published on 18 Aug 2026. 

### Official description

comander-lib@1.0.0 is a typosquat of `commander` with an empty index.js and no native sources. Its scripts/postinstall.js runs automatically on `npm install` and performs two hostile actions. First, it POSTs the installer's platform label as JSON to a hardcoded bare-IP C2 at http://193.70.34.101:20099/vote, with the host built via array-join (`['193','70','34','101'].join('.')`) to hide the literal. Second, it XOR-decodes (key `stf2026`) an attacker-controlled github.com URL and fetches an executable to `%TEMP%/main.exe`, then spawns it detached with `windowsHide:true` on Windows. On WSL/virtualized Linux it XOR-decodes a PowerShell bridge command and invokes it to execute the same payload on the Windows host, escaping the Linux sandbox. Addon URL, PowerShell launcher, and script fragments are all stored as XOR-encoded byte arrays decoded at runtime, concealing the destination and command surface. The package advertises itself as a native-addon mirror but ships no addon code, confirming a pure dropper cover story.

## What should I do about MAL-2026-14171?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-14171 is a malicious package: comander-lib (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-14171/ (Markdown: https://insights.sbomify.com/MAL-2026-14171/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-14171

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-14171/
Summaries are generated and may contain mistakes; the official description above is the record.