typescirpt-core

{"modified":"2026-08-18T23:20:47Z","published":"2026-08-18T23:20:47Z","schema_version":"1.7.4","id":"MAL-2026-14149","summary":"Malicious code in typescirpt-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ef20a464d9f616eecfd6457a02895da80d1fabf558ef49de83dca18046551e90)\nPackage name 'typescirpt-core' typosquats 'typescript'. scripts/postinstall.js runs automatically on npm install and posts a JSON platform beacon to a hardcoded bare-IP endpoint at http://193.70.34.101:20099/vote (host constructed by array-join to evade static matching). It then XOR-decodes (key 'stf2026') an embedded integer array into a remote URL and downloads a Windows executable to %TEMP%/main.exe, spawning it detached with stdio ignored and window hidden. A separate WSL-detection branch XOR-decodes a PowerShell bridge launcher and pre/post script fragments and passes the reconstructed command to child_process.exec, so a Linux WSL install pivots execution back to the host Windows side. The URL, launcher command, and script fragments are all stored as XOR-encoded byte arrays and reconstructed at runtime immediately before exec/https.get, hiding the download destination and command line from static inspection.\n","affected":[{"package":{"ecosystem":"npm","name":"typescirpt-core"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/postinstall.js","sha256":"9add9254ecb92b4ad1daddf025cc9cf2b9be12d324fcc671316b6cc6f4bab1b0","tlsh":"40d13fc61ef59035874bf96884cf9d13b2a6c207330e4a65ff8f42107f5792c85a69ea"}],"package_integrity":[{"filename":"typescirpt-core-1.0.0.tgz","hashes":{"sha1":"624251d4805f129ab64cce5c6f53008f2918d56b","sha512_sri":"sha512-uAuMrM1Awl/XyUW2rgBcdDmZLSdBIf8REeJHLFQuc1JeGnQH9uoWidflvPkAL+ysHKWIme7ft3+WDz4cMpwFdA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/typescirpt-core/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018188","import_time":"2026-08-18T23:41:22.262469767Z","modified_time":"2026-08-18T23:20:47Z","sha256":"ef20a464d9f616eecfd6457a02895da80d1fabf558ef49de83dca18046551e90","source":"amazon-inspector","versions":["1.0.0"]}]}}