typscript-core @1.0.0
Vulnerability report · Last retrieved from osv.dev August 19, 2026 at 3:49 AM UTC
OSV ID
MAL-2026-14157
Ecosystem
npm
Summary
typscript-core is a typosquat of the 'typescript' package. Its scripts/postinstall.js reconstructs a GitHub download URL and shell commands from byte arrays XOR-decoded with the key 'stf2026', downloads a binary to %TEMP%\main.exe, and spawns it detached with windowsHide:true on win32 (and via a PowerShell bridge on WSL). The same postinstall also POSTs platform information to a hardcoded bare-IP endpoint at http://193.70.34.101:20099/vote, with the IP assembled from a four-element string array to evade static search. The URLs, shell commands, and destination IP are all obfuscated and reconstructed at runtime.
Source: amazon-inspector (5120bfde64344d0e161bac3b4128d7eeecc483ad796361db09eacd138ecd3945)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.