Malicious code in typescipt-core (npm)
The npm package typescipt-core (a typosquat of typescript) contained malicious postinstall code that downloads and executes a second-stage payload on Windows and WSL systems. The dropper exfiltrates host profile information to 193.70.34.101:20099 before fetching attacker-controlled executables.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed the malicious typescipt-core package
- Ecosystems
- Attack vectors
- Affected entities
- typescipt-coreTyposquatting package masquerading as typescript
The npm package typescipt-core is a typosquatting variant of the legitimate typescript package. Upon installation, its postinstall script (scripts/postinstall.js) executes malicious code that XOR-decodes obfuscated URLs and commands using the key 'stf2026'.
On Windows systems, the script fetches an executable to %TEMP%\main.exe and spawns it. On WSL systems, it decodes and executes a PowerShell bridge via exec. Before fetching the second-stage payload, the malware POSTs a host-profile JSON (including Windows/WSL identification derived from /proc/version and /proc/sys/kernel/osrelease) over plain HTTP to the hardcoded IP 193.70.34.101 on port 20099 at path /vote.
The network destinations and shell commands are stored as XOR-encoded byte arrays (ADDON_ENC, BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) and reconstructed at runtime. The malware uses cover-story identifiers ('TELEMETRY', 'addon') to mask its true purpose as an install-time dropper.
This incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- typescipt-core
- IPs
- 193.70.34.101
Remediation
- Immediately uninstall typescipt-core from all systems where it was installed
- Audit npm install logs to identify all hosts that installed typescipt-core
- Scan affected systems for the presence of %TEMP%\main.exe or related artifacts
- Review network logs for outbound HTTP connections to 193.70.34.101:20099
- Regenerate credentials and API keys on any affected development machines
- Update npm package lock files to remove typescipt-core and use the legitimate typescript package instead
- Consider blocking the IP 193.70.34.101 at the network perimeter
Sources
- GitHub Advisory GHSA-7qw6-43q5-x2pf · GitHub Advisory Database
Cite this entry
"Malicious code in typescipt-core (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-typescipt-core-npm-1qgvg9
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package