typescirpt-cli

{"modified":"2026-08-18T23:20:31Z","published":"2026-08-18T23:20:31Z","schema_version":"1.7.4","id":"MAL-2026-14148","summary":"Malicious code in typescirpt-cli (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (09d82fa51e42e6766fe0819517e9fb5be633702a0e22cb4da05d8920cb413c53)\nThe package's postinstall script (scripts/postinstall.js) XOR-decodes obfuscated byte arrays using the key 'stf2026' to reconstruct a download URL and a powershell command. On Windows, and on Linux when WSL is detected, it downloads an opaque main.exe from https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe (an unrelated personal GitHub account, no version tag, no hash/signature verification) into TEMP and spawns it detached; from WSL it invokes a decoded powershell.exe bridge to fetch and run the binary on the Windows host. Separately, sendInstallMetrics POSTs a JSON payload containing node/arch/platform to the hardcoded bare IP 193.70.34.101:20099/vote over plain HTTP, with the host reconstructed via array-join to obscure the literal. The package name typosquats 'typescript-cli'.\n","affected":[{"package":{"ecosystem":"npm","name":"typescirpt-cli"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/postinstall.js","sha256":"40d3f8ab5dd2c4ac6b4b68c463795ceb22365bdb6514be8ac5b00c89052f3c09","tlsh":"70d13fca1ef59035874bf96884cf9d13b2a6c207320d4a65ff8f42107f5793c85a69e9"}],"package_integrity":[{"filename":"typescirpt-cli-1.0.0.tgz","hashes":{"sha1":"69a0fde4d6a94840d91d1afc2897f1c8e373e7d1","sha512_sri":"sha512-O84z83aTmYL8JVsq1gaaVbBmSlmVDqUlfkUmA+PPE9csvdd3yoNqjKyXWrGXWYDY4U61YPPykQ/L8DFBQYpnNg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/typescirpt-cli/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018186","import_time":"2026-08-18T23:41:22.046812686Z","modified_time":"2026-08-18T23:20:31Z","sha256":"09d82fa51e42e6766fe0819517e9fb5be633702a0e22cb4da05d8920cb413c53","source":"amazon-inspector","versions":["1.0.0"]}]}}