Malicious code in typecript-cli (npm)
typecript-cli@1.0.0 is a typosquat of the legitimate 'typescript' package that contains malicious postinstall code. The package downloads and executes main.exe on Windows and WSL systems, and beacons to a command-and-control server.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed typecript-cli@1.0.0 from npm, particularly Windows and WSL users.
- Ecosystems
- Attack vectors
- Affected entities
- typecript-cli · 1.0.0
typecript-cli@1.0.0 is a typosquatting attack targeting developers who may mistype the legitimate 'typescript' package name. The malicious package contains obfuscated code in scripts/postinstall.js that executes during installation.
The postinstall script uses XOR decoding (key 'stf2026') to hide its payload from static analysis. On Windows hosts, it downloads main.exe from a personal GitHub account (https://github.com/bebraz1/releases/download/main.exe) to %TEMP%/main.exe and executes it without verification. When running under WSL, the script uses a PowerShell bridge to escape the Linux sandbox and execute the same payload on the Windows host.
The script also beacons to http://193.70.34.101:20099/vote with a JSON POST containing the resolved platform label, using obfuscated IP assembly to evade detection. This serves as both an install beacon and host selector for the attacker.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- typecript-cli@1.0.0
- Domains
- github.com/bebraz1
- IPs
- 193.70.34.101
Remediation
- Immediately uninstall typecript-cli from any affected systems
- Verify that the correct 'typescript' package is installed instead
- Scan systems that installed typecript-cli@1.0.0 for main.exe in %TEMP% and any suspicious processes
- Review npm package names carefully before installation to avoid typosquatting attacks
- Consider using npm package lock files and dependency verification tools to prevent installation of unexpected packages
- Monitor for outbound connections to 193.70.34.101:20099 on affected networks
Sources
- GitHub Advisory GHSA-fvrh-vm8j-qf7v · GitHub Advisory Database
Cite this entry
"Malicious code in typecript-cli (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-typecript-cli-npm-j9o3o8
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package