Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in typesript-cli (npm)

The npm package 'typesript-cli' (a one-character typosquat of 'typescript') contains malicious code in its postinstall script that downloads and executes a Windows PE binary, and can cross the Linux/WSL sandbox boundary to execute payloads on the Windows host. The script also beacons to a hardcoded IP endpoint.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or system installing the malicious typesript-cli package from npm; Windows systems and WSL environments particularly affected due to payload execution capabilities.
Ecosystems
npm
Attack vectors
TyposquattingCompromised package
Affected entities
  • typesript-cliTyposquat of 'typescript' package; contains malicious postinstall script

The npm package 'typesript-cli' is a typosquat of the widely-used 'typescript' package, designed to deceive developers into installing it. Upon installation, the package's postinstall.js script XOR-decodes (using key 'stf2026') a GitHub-hosted URL and downloads a Windows PE executable to TEMP\main.exe, then spawns it without hash or signature verification.

The malicious script includes sandbox-escape functionality: when running under WSL or virtualized Linux (detected via /proc/version and WSLENV environment variables), it decodes additional XOR-obfuscated payloads and executes them via child_process.exec with windowsHide:true to fetch and run the same payload on the Windows host, crossing the Linux sandbox boundary.

The script also performs reconnaissance by POSTing platform information to a hardcoded bare-IP endpoint (http://193.70.34.101:20099/vote), with the IP address obfuscated across a string array to evade static analysis.

This incident was identified and credited to the OpenSSF's malicious-packages repository.

Indicators of compromise

Packages
  • typesript-cli
IPs
  • 193.70.34.101

Remediation

  • Immediately uninstall typesript-cli from all systems: npm uninstall typesript-cli
  • Audit npm install logs and package-lock.json files to identify systems that installed this package
  • Scan affected Windows systems for the presence of TEMP\main.exe and any suspicious child processes spawned during installation
  • Review network logs for connections to 193.70.34.101:20099
  • If installed, assume potential compromise and perform forensic analysis for lateral movement or data exfiltration
  • Use the correct 'typescript' package (note the correct spelling) for legitimate TypeScript tooling
  • Implement npm package name verification practices and consider using npm audit or similar tools to detect typosquats

Sources

  1. GitHub Advisory GHSA-466h-g3vr-3r66 · GitHub Advisory Database

Cite this entry

"Malicious code in typesript-cli (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-typesript-cli-npm-q31kuq

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in create-coin (npm)

    create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.

    npmCompromised packageTyposquatting
  2. containedcritical

    Malicious code in chai-as-testkit (npm)

    The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.

    npmTyposquattingCompromised package
  3. resolvedcritical

    Malicious code in @next-fonts/font (npm)

    @next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.

    npmTyposquattingCompromised package
  4. resolvedcritical

    Malicious code in chai-as-soul (npm)

    chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.

    npmTyposquattingCompromised package