Malicious code in typescriptt-core (npm)

typescriptt-core is a typosquatting attack targeting the TypeScript ecosystem, using a double-t in the package name to evade detection. The package contains no legitimate functionality—its main export is an empty object—and all malicious behavior is triggered by a postinstall script.

The postinstall.js script uses XOR obfuscation with the fixed key 'stf2026' to decode a hidden URL and PowerShell launcher command. On Windows systems, it downloads main.exe from https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe to the %TEMP% directory and executes it with detached process spawning. On WSL, the script decodes a bridge command and invokes powershell.exe on the Windows host to perform the same fetch-and-run operation.

Before executing the payload, the postinstall script sends an install beacon—a small JSON payload containing the host platform label—to http://193.70.34.101:20099/vote over plain HTTP. The destination GitHub account (bebraz1) is unrelated to the official TypeScript project, and both the URL and PowerShell command are obfuscated to defeat static code review.

This incident was identified and credited to the OpenSSF's malicious-packages repository.