OpenSSF/OSV advisory MAL-2026-14147 confirms this npm version as malicious. Package name typosquats `typescript`. The postinstall script (scripts/postinstall.js) XOR-decodes a download URL and a PowerShell launcher using key 'stf2026', then on Windows fetches an executable to %TEMP%\main.exe and spawns it detached; on WSL it decodes and executes a PowerShell bridge via exec...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in typescipt-core (npm)
Details
Package name typosquats `typescript`. The postinstall script (scripts/postinstall.js) XOR-decodes a download URL and a PowerShell launcher using key 'stf2026', then on Windows fetches an executable to %TEMP%\main.exe and spawns it detached; on WSL it decodes and executes a PowerShell bridge via exec. Before fetching the second stage, it POSTs a host-profile JSON (including a Windows/WSL label derived from inspecting /proc/version and /proc/sys/kernel/osrelease) over plain HTTP to the hardcoded bare IP 193.70.34.101 on port 20099 at path /vote. The network destinations and shell command are stored as XOR-encoded byte arrays (ADDON_ENC, BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) and reconstructed at runtime. Cover-story identifiers ('TELEMETRY', 'addon') mask an install-time dropper: `npm install typescipt-core` results in attacker-controlled code executing on the installer's host.
Decision reason
OpenSSF Malicious Packages via OSV confirms typescipt-core@1.0.0 as malicious (MAL-2026-14147): Malicious code in typescipt-core (npm)