Malicious code in typescipt-cli (npm)
The npm package typescipt-cli (a typosquat of 'typescript') contained malicious code in its postinstall script that exfiltrated system information, downloaded a Windows executable, and executed it with obfuscated C2 communication.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious typescipt-cli package from npm
- Ecosystems
- Attack vectors
- Affected entities
- typescipt-cliTyposquatting package for 'typescript'
The npm package typescipt-cli was a typosquatting attack targeting the legitimate 'typescript' package. The malicious package contained obfuscated code in scripts/postinstall.js that executed at install time.
The postinstall script performed three main malicious actions: (1) POSTed JSON data containing the installer's platform label to a C2 server at 193.70.34.101:20099/vote, with the IP address obfuscated as a reconstructed string array; (2) XOR-decoded a hardcoded URL (github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe) using the key 'stf2026', downloaded the resulting binary to %TEMP%\main.exe on Windows systems, and executed it with hidden window mode; (3) on WSL environments, XOR-decoded and executed a PowerShell bridge command to run the same download on the host Windows system.
All malicious URLs, commands, and the C2 IP address were stored as encoded byte arrays and reconstructed at runtime to evade detection. No hash or signature verification was performed on the downloaded executable.
The incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- typescipt-cli
- Domains
- github.com/bebraz1/qPzM50V1AKG0rVlH
- IPs
- 193.70.34.101
Remediation
- Review the linked advisory; remove or upgrade the affected component and rotate any exposed credentials.
Sources
- GitHub Advisory GHSA-6cm8-qm6q-f3v3 · GitHub Advisory Database
Cite this entry
"Malicious code in typescipt-cli (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-typescipt-cli-npm-1r55nm
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package