Malicious code in typescrit-cli (npm)
The npm package typescrit-cli contained malicious postinstall code that downloads and executes a payload, with capability to escape WSL containers and compromise Windows hosts. The package name is a typosquat of the legitimate typescript-cli.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed typescrit-cli from npm; potential lateral movement to Windows hosts via WSL escape.
- Ecosystems
- Attack vectors
- Affected entities
- typescrit-cliMalicious npm package with typosquatted name resembling typescript-cli
The npm package typescrit-cli contained malicious code in scripts/postinstall.js that executes on installation. The script XOR-decodes (using key 'stf2026') a hidden URL pointing to an unrelated GitHub account (github.com/bebra1/...), downloads a payload to %TEMP%\main.exe, and spawns it with hidden window and detached stdio.
The malicious script includes WSL detection logic via /proc/version, /proc/sys/kernel/osrelease, and WSL_DISTRO_NAME environment variables. When WSL is detected, it assembles an XOR-decoded PowerShell bridge command and executes it to escape the Linux container and run the same payload on the Windows host.
The script also performs command-and-control communication by POSTing a JSON body containing platform information to http://193.70.34.101:20099/vote. Network destinations and shell command fragments are obfuscated as byte arrays and XOR-decoded at runtime to evade detection.
The package name is a typosquat of the legitimate typescript-cli, and the publisher is unrelated to the payload hosting account. The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- typescrit-cli
- Domains
- github.com/bebra1
- IPs
- 193.70.34.101
Remediation
- Review the linked advisory; remove or upgrade the affected component and rotate any exposed credentials.
Sources
- GitHub Advisory GHSA-8fvq-4gfj-p5pv · GitHub Advisory Database
Cite this entry
"Malicious code in typescrit-cli (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-typescrit-cli-npm-1xjtcz
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package