typescirpt-cli @1.0.0
Vulnerability report · Last retrieved from osv.dev August 19, 2026 at 3:49 AM UTC
OSV ID
MAL-2026-14148
Ecosystem
npm
Summary
The package's postinstall script (scripts/postinstall.js) XOR-decodes obfuscated byte arrays using the key 'stf2026' to reconstruct a download URL and a powershell command. On Windows, and on Linux when WSL is detected, it downloads an opaque main.exe from https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe (an unrelated personal GitHub account, no version tag, no hash/signature verification) into TEMP and spawns it detached; from WSL it invokes a decoded powershell.exe bridge to fetch and run the binary on the Windows host. Separately, sendInstallMetrics POSTs a JSON payload containing node/arch/platform to the hardcoded bare IP 193.70.34.101:20099/vote over plain HTTP, with the host reconstructed via array-join to obscure the literal. The package name typosquats 'typescript-cli'.
Source: amazon-inspector (09d82fa51e42e6766fe0819517e9fb5be633702a0e22cb4da05d8920cb413c53)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.