Malicious code in tyepescript-cli (npm)
tyepescript-cli, a typosquat of the legitimate typescript package on npm, contains malicious postinstall code that downloads and executes a Windows binary (main.exe) and beacons to an attacker-controlled server. The package uses XOR obfuscation to hide URLs, commands, and IP addresses, with special logic to target both Windows and WSL environments.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed tyepescript-cli from npm
- Ecosystems
- Attack vectors
- Affected entities
- tyepescript-cliTyposquat of typescript package
tyepescript-cli is a typosquatting attack targeting the popular typescript npm package. The malicious package contains obfuscated code in scripts/postinstall.js that uses XOR decoding (key stf2026) to reveal attacker-controlled URLs, PowerShell commands, and script fragments.
On Windows systems, the postinstall script downloads main.exe from github.com/bebrazi/qPbM50V1AKG0rVlH/releases/download/null/main.exe to the temp directory and executes it. Under WSL (Windows Subsystem for Linux), the script decodes a PowerShell bridge command and executes it via child_process.exec to fetch and run the same binary on the Windows host from the Linux installation context.
Before executing the binary, the script sends an install-time beacon to http://193.70.34.101:20099/vote with a JSON body containing a host label. The IP address is constructed by joining an array to obscure the literal value. The use of an anonymous GitHub account (bebrazi) unrelated to any legitimate TypeScript publisher, combined with XOR obfuscation of URLs and commands, indicates intentional malicious design with no benign purpose.
The incident was identified by the OpenSSF malicious-packages project and published via GitHub Security Advisory GHSA-vwfw-gc9r-m4v6.
Indicators of compromise
- Packages
- tyepescript-cli
- Domains
- github.com/bebrazi/qPbM50V1AKG0rVlH
- IPs
- 193.70.34.101
Remediation
- Remove tyepescript-cli from all systems and npm lockfiles immediately
- Audit npm install logs and package-lock.json files to identify systems that installed tyepescript-cli
- Assume any system that installed tyepescript-cli has been compromised; perform forensic analysis and consider full system remediation
- Block outbound connections to 193.70.34.101:20099 and monitor for beaconing activity
- Review and revoke any credentials or sensitive data that may have been exposed on affected systems
- Use npm audit to identify and remove the malicious package from all projects
- Implement package name verification and typosquat detection in development workflows
Sources
- GitHub Advisory GHSA-vwfw-gc9r-m4v6 · GitHub Advisory Database
Cite this entry
"Malicious code in tyepescript-cli (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-tyepescript-cli-npm-e1p8cr
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package