typescipt-core @1.0.0

Summary

Package name typosquats typescript . The postinstall script (scripts/postinstall.js) XOR-decodes a download URL and a PowerShell launcher using key 'stf2026', then on Windows fetches an executable to %TEMP%\main.exe and spawns it detached; on WSL it decodes and executes a PowerShell bridge via exec. Before fetching the second stage, it POSTs a host-profile JSON (including a Windows/WSL label derived from inspecting /proc/version and /proc/sys/kernel/osrelease) over plain HTTP to the hardcoded bare IP 193.70.34.101 on port 20099 at path /vote. The network destinations and shell command are stored as XOR-encoded byte arrays (ADDON_ENC, BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) and reconstructed at runtime. Cover-story identifiers ('TELEMETRY', 'addon') mask an install-time dropper: npm install typescipt-core results in attacker-controlled code executing on the installer's host.

Source: amazon-inspector (98b97af3a328b837904c7860b7acbae33bea28afb53949905868867905c14be6)