OpenSSF/OSV advisory MAL-2026-14152 confirms this npm version as malicious. typescriptt-core is a typosquat of the TypeScript ecosystem (double-t) with an empty main (module.exports = {}) and no library functionality. The only code that runs is scripts/postinstall.js, which XOR-decodes a hidden URL and PowerShell launcher using the fixed key 'stf2026' and, on Windows, downloads main.exe from https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe to %TEMP% and spawns it...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in typescriptt-core (npm)
Details
typescriptt-core is a typosquat of the TypeScript ecosystem (double-t) with an empty main (module.exports = {}) and no library functionality. The only code that runs is scripts/postinstall.js, which XOR-decodes a hidden URL and PowerShell launcher using the fixed key 'stf2026' and, on Windows, downloads main.exe from https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe to %TEMP% and spawns it detached. On WSL, the same script decodes a bridge command and invokes powershell.exe on the Windows host to perform the same fetch-and-run. Before the drop, postinstall POSTs a small JSON payload containing the host platform label to a hardcoded bare-IP endpoint http://193.70.34.101:20099/vote over plain HTTP as an install beacon. The destination GitHub account (bebraz1) is unrelated to the TypeScript project, the payload is opaque, and both the URL and the PowerShell command are XOR-obfuscated to defeat static review.
Decision reason
OpenSSF Malicious Packages via OSV confirms typescriptt-core@1.0.0 as malicious (MAL-2026-14152): Malicious code in typescriptt-core (npm)