Malicious code in typescirpt-cli (npm)
The npm package typescirpt-cli (a typosquat of typescript-cli) contained malicious code in its postinstall script that downloads and executes a binary (main.exe) on Windows and WSL systems, and exfiltrates system metadata to a hardcoded IP address.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed the malicious typescirpt-cli package
- Ecosystems
- Attack vectors
- Affected entities
- typescirpt-cliTyposquatting attack on typescript-cli
The malicious npm package typescirpt-cli employed typosquatting to mimic the legitimate typescript-cli package. The postinstall script (scripts/postinstall.js) contained obfuscated code that XOR-decoded byte arrays using the key 'stf2026' to reconstruct a download URL and PowerShell command.
On Windows systems and on Linux when WSL (Windows Subsystem for Linux) was detected, the script downloaded an opaque executable (main.exe) from https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe—hosted on an unrelated personal GitHub account with no version tag or cryptographic verification—into the TEMP directory and executed it. From WSL, the malware invoked a decoded PowerShell bridge to fetch and run the binary on the Windows host.
Additionally, the package's sendInstallMetrics function exfiltrated system information (node version, architecture, and platform details) via HTTP POST to the hardcoded IP address 193.70.34.101:20099/vote, with the host address obfuscated via array-join operations to evade detection.
The incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- typescirpt-cli
- Domains
- github.com/bebraz1/qPzM50V1AKG0rVlH
- IPs
- 193.70.34.101
Remediation
- Immediately uninstall typescirpt-cli from all systems
- Audit npm install logs to identify when the package was installed
- Scan affected systems for the presence of main.exe in TEMP directories
- Review Windows and WSL process execution logs for suspicious activity during the installation window
- Check for outbound HTTP connections to 193.70.34.101:20099
- Use npm audit to verify no other malicious packages are installed
- Consider running antivirus/malware scans on affected systems
- Update to the legitimate typescript-cli package if TypeScript CLI functionality is needed
Sources
- GitHub Advisory GHSA-499v-xc9v-93mc · GitHub Advisory Database
Cite this entry
"Malicious code in typescirpt-cli (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-typescirpt-cli-npm-9ybi41
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package