Malicious code in typescrip-cli (npm)
The npm package typescrip-cli is a typosquatting attack on typescript-cli that contains malicious postinstall code. The package downloads and executes a Windows executable from a remote GitHub account and can bridge WSL/virtualized Linux environments to execute payloads on the Windows host, while also beaconing to a hardcoded IP address.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious typescrip-cli package from npm
- Ecosystems
- Attack vectors
- Affected entities
- typescrip-cliTyposquatting package for typescript-cli
The npm package typescrip-cli is a typosquatting variant of the legitimate typescript-cli package. The malicious package exports an empty object with no actual library functionality, masking its true purpose.
The attack is executed through a postinstall script (scripts/postinstall.js) that uses obfuscation techniques to hide its malicious behavior. Network destinations and command lines are encoded as numeric byte arrays and XOR-decoded at runtime using the key 'stf2026'. The decoded URL points to https://github.com/bebra1/qPzM50V1AKG0rVlH/releases/download/null/main.exe, hosted on an unrelated personal GitHub account with a mutable release tag.
On Windows systems, the script downloads the executable to %TEMP%\main.exe and spawns it detached. On WSL or virtualized Linux environments, the script decodes a PowerShell launcher and bridge script, executing the same payload on the Windows host across the WSL boundary. In parallel, the postinstall script beacons to http://193.70.34.101:20099/vote with host platform identification, using obfuscated IP address construction to evade detection.
This incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- typescrip-cli
- Domains
- github.com
- IPs
- 193.70.34.101
Remediation
- Immediately uninstall typescrip-cli from all systems and projects
- Audit npm install logs and package-lock.json files to identify if typescrip-cli was ever installed
- Scan systems that installed this package for the presence of %TEMP%\main.exe or related artifacts
- Review network logs for connections to 193.70.34.101:20099
- Use npm audit to check for this package in dependency trees
- Verify that the legitimate typescript-cli package is installed instead if TypeScript CLI functionality is needed
- Consider running security scans on any system that executed the postinstall script
Sources
- GitHub Advisory GHSA-w5r3-cmwg-p8cq · GitHub Advisory Database
Cite this entry
"Malicious code in typescrip-cli (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-typescrip-cli-npm-1qflfw
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package