Malicious code in tyepescript-core (npm)
The npm package 'tyepescript-core' is a typosquat of 'typescript' that executes arbitrary attacker-controlled code during installation. The malicious postinstall script downloads and executes a Windows binary and beacons to attacker infrastructure.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious tyepescript-core package from npm
- Ecosystems
- Attack vectors
- Affected entities
- tyepescript-coreTyposquat of 'typescript' package; contains malicious postinstall script
The npm package 'tyepescript-core' is a typosquat targeting the legitimate 'typescript' package. While the module itself exports an empty stub, the malicious code is embedded in scripts/postinstall.js.
The postinstall script uses XOR decoding (key 'stf2026') to reconstruct a download URL and shell command at runtime, then fetches an opaque Windows binary to %TEMP%\main.exe and executes it with detached stdio. On WSL and virtualized-Linux hosts, a second XOR-decoded 'bridge' command is passed to child_process.exec to reach the Windows host.
Additionally, the postinstall script POSTs a JSON body containing the resolved platform label to http://193.70.34.101:20099/vote, with the bare-IP host assembled at runtime from a string array to evade detection. This serves as an install beacon to attacker infrastructure.
The result is arbitrary code execution on the installer's machine at 'npm install' time, plus reconnaissance of the target platform.
Indicators of compromise
- Packages
- tyepescript-core
- IPs
- 193.70.34.101
Remediation
- Immediately uninstall tyepescript-core from all systems where it was installed
- Audit systems that installed tyepescript-core for signs of compromise, including unexpected processes, network connections to 193.70.34.101:20099, and files in %TEMP%
- Use the correct 'typescript' package instead of 'tyepescript-core'
- Implement package name verification and typosquat detection in dependency management workflows
- Monitor npm for similar typosquats of popular packages
Sources
- GitHub Advisory GHSA-cgqx-rp6q-g757 · GitHub Advisory Database
Cite this entry
"Malicious code in tyepescript-core (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-tyepescript-core-npm-wlbcmj
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package