Malicious code in typescirpt-core (npm)
The npm package 'typescirpt-core' (a typosquat of 'typescript') contained malicious code that executed on install, downloading and executing a Windows executable and pivoting WSL environments back to the host Windows system.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious typescirpt-core package from npm
- Ecosystems
- Attack vectors
- Affected entities
- typescirpt-coreTyposquatting package for 'typescript'
The npm package 'typescirpt-core' is a typosquatting attack targeting the legitimate 'typescript' package. The malicious package contains a postinstall script (scripts/postinstall.js) that executes automatically when the package is installed via npm.
The postinstall script performs several malicious actions: it sends a JSON beacon to a hardcoded IP endpoint (http://193.70.34.101:20099/vote), then XOR-decodes (using key 'stf2026') an embedded integer array to reconstruct a remote URL. It downloads a Windows executable to %TEMP%/main.exe and spawns it with detached stdio and hidden window.
For systems with Windows Subsystem for Linux (WSL), the malware includes a separate detection branch that XOR-decodes a PowerShell bridge launcher and script fragments, reconstructing them at runtime before execution. This allows the malware to pivot from a Linux WSL environment back to the host Windows system.
All malicious payloads—the download URL, launcher commands, and script fragments—are stored as XOR-encoded byte arrays and reconstructed immediately before execution, evading static code inspection and analysis.
Indicators of compromise
- Packages
- typescirpt-core
- IPs
- 193.70.34.101
Remediation
- Immediately uninstall the 'typescirpt-core' package from all affected systems
- Scan systems that installed this package for the presence of %TEMP%/main.exe or other suspicious executables
- Review npm install logs to identify which systems or developers may have installed this package
- Use the legitimate 'typescript' package instead, verifying the correct spelling
- Consider implementing npm package name verification and typosquatting detection in your dependency management process
- If WSL is in use, check for unexpected PowerShell execution or script fragments in Windows event logs
Sources
- GitHub Advisory GHSA-vx5p-ww9v-vf9p · GitHub Advisory Database
Cite this entry
"Malicious code in typescirpt-core (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-typescirpt-core-npm-1yn3be
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package