{"id":"MAL-2026-14234","summary":"Malicious code in commandor-lib (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2e184348abf5c5ce61ee6c4e63189411a08755e57e95dac33c666adae7c6dc2d)\nThe package's scripts/postinstall.js runs automatically on npm install and imports child_process alongside http.request with multiple POST call sites (lines 13, 95, 194). This pattern in a lifecycle hook — spawning subprocesses and posting data to an external HTTP endpoint at install time — is consistent with installer-side reconnaissance and exfiltration to an author-controlled destination and does not correspond to any documented purpose of a generically named library package.\n","modified":"2026-08-19T04:00:18.408225001Z","published":"2026-08-19T03:42:52Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018334","import_time":"2026-08-19T03:49:30.81864293Z","modified_time":"2026-08-19T03:42:52Z","sha256":"2e184348abf5c5ce61ee6c4e63189411a08755e57e95dac33c666adae7c6dc2d","source":"amazon-inspector","versions":["1.0.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/commandor-lib/v/1.0.0"}],"affected":[{"package":{"name":"commandor-lib","ecosystem":"npm","purl":"pkg:npm/commandor-lib"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"path":"scripts/postinstall.js","sha256":"1edaf0ae232e5ef6665ae3c08bff2132da50dc6a72db2d0dc1c289fff622f63d","tlsh":"31d13fc61ef5a036874bf96884cf9d13b2a6c207330d4a65fb8f42107f5792c85a69d6"}],"package_integrity":[{"filename":"commandor-lib-1.0.0.tgz","hashes":{"sha512_sri":"sha512-t4ubzf5RMWt5Bf1K3El4KFyIVgV9CLOUZbc85e3kC5fwBitEJTHsqqVGaNFY2hbkABOKJp03rU3UVqf86Wa6qA==","sha1":"042830b450784aef86e318e5d8920c2e818445cc"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/commandor-lib/MAL-2026-14234.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}