Malicious code in typescriptt-cli (npm)
typescriptt-cli, a typosquat of typescript-cli on npm, contained malicious code in its postinstall script that downloads and executes a Windows binary from a GitHub release, with capability to break out of WSL environments to the host Windows system.
- Disclosed
- Last updated
- Blast radius
- npm ecosystem; any developer or system installing typescriptt-cli
- Ecosystems
- Attack vectors
- Affected entities
- typescriptt-clityposquat of typescript-cli
typescriptt-cli is a typosquatting package targeting the legitimate typescript-cli. The package's index.js is empty; all malicious behavior is contained in scripts/postinstall.js.
Upon npm install, the postinstall script XOR-decodes a hardcoded byte array (using key 'stf2026') to reconstruct a URL pointing to github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe. The script downloads this Windows executable to %TEMP%\main.exe and spawns it detached with windowsHide:true and stdio:'ignore'.
For WSL environments, the script detects the presence of WSL by scanning /proc/version and /proc/sys/kernel/osrelease for 'microsoft', then assembles a PowerShell command from three additional XOR-obfuscated byte arrays to fetch and execute the same binary on the Windows host, effectively breaking out of the WSL boundary.
Before the malware drop, the script POSTs a JSON platform label to a tracking endpoint at http://193.70.34.101:20099/vote. The download URL uses a personal GitHub account with no hash or signature verification, and the executable payload is opaque.
Indicators of compromise
- Packages
- typescriptt-cli
- Domains
- github.com
- IPs
- 193.70.34.101
Remediation
- Remove typescriptt-cli from all systems immediately
- Audit npm install logs for any installations of typescriptt-cli
- Scan systems that installed typescriptt-cli for the presence of main.exe in %TEMP% and any suspicious process execution
- Use the legitimate typescript-cli package instead
- Implement package name verification and typosquat detection in dependency management workflows
- Monitor for suspicious outbound connections to 193.70.34.101:20099
Sources
- GitHub Advisory GHSA-69f6-xvgh-438f · GitHub Advisory Database
Cite this entry
"Malicious code in typescriptt-cli (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-typescriptt-cli-npm-b1ycfc
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package