OpenSSF/OSV advisory MAL-2026-14155 confirms this npm version as malicious. typesript-core@1.0.0 is a typosquat of 'typescript' whose index.js is an empty object; the package has no library functionality. Its only behavior is scripts/postinstall.js, which runs automatically on npm install. The script XOR-decodes (key 'stf2026') a hardcoded payload URL, array-joins the C2 host 193.70.34.101 to hide the literal IP, POSTs a host-fingerprint JSON body ({platform: label}) to...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in typesript-core (npm)
Details
typesript-core@1.0.0 is a typosquat of 'typescript' whose index.js is an empty object; the package has no library functionality. Its only behavior is scripts/postinstall.js, which runs automatically on npm install. The script XOR-decodes (key 'stf2026') a hardcoded payload URL, array-joins the C2 host 193.70.34.101 to hide the literal IP, POSTs a host-fingerprint JSON body ({platform: label}) to http://193.70.34.101:20099/vote, then downloads a Windows PE to %TEMP%\main.exe and spawns it detached with stdio ignored and windowsHide set. When run under WSL, a separately XOR-decoded PowerShell 'bridge' command is exec'd to fetch and launch the same binary on the Windows host. Payload URL, PowerShell bridge invocation, and pre/post script fragments are all shipped as XOR-encoded byte arrays and decoded at runtime.
Decision reason
OpenSSF Malicious Packages via OSV confirms typesript-core@1.0.0 as malicious (MAL-2026-14155): Malicious code in typesript-core (npm)