typescirpt-core @1.0.0
Vulnerability report · Last retrieved from osv.dev August 19, 2026 at 3:49 AM UTC
OSV ID
MAL-2026-14149
Ecosystem
npm
Summary
Package name 'typescirpt-core' typosquats 'typescript'. scripts/postinstall.js runs automatically on npm install and posts a JSON platform beacon to a hardcoded bare-IP endpoint at http://193.70.34.101:20099/vote (host constructed by array-join to evade static matching). It then XOR-decodes (key 'stf2026') an embedded integer array into a remote URL and downloads a Windows executable to %TEMP%/main.exe, spawning it detached with stdio ignored and window hidden. A separate WSL-detection branch XOR-decodes a PowerShell bridge launcher and pre/post script fragments and passes the reconstructed command to child_process.exec, so a Linux WSL install pivots execution back to the host Windows side. The URL, launcher command, and script fragments are all stored as XOR-encoded byte arrays and reconstructed at runtime immediately before exec/https.get, hiding the download destination and command line from static inspection.
Source: amazon-inspector (ef20a464d9f616eecfd6457a02895da80d1fabf558ef49de83dca18046551e90)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.