Malicious code in typesript-core (npm)
typesript-core@1.0.0 is a typosquat of the legitimate 'typescript' package containing malicious postinstall code that downloads and executes a Windows PE binary from a remote C2 server (193.70.34.101:20099). The package uses XOR encoding to obfuscate the payload URL and C2 communication, and includes a PowerShell bridge for WSL environments.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed typesript-core@1.0.0 via npm; the postinstall script executes automatically on installation.
- Ecosystems
- Attack vectors
- Affected entities
- typesript-core · 1.0.0
typesript-core@1.0.0 is a typosquatting attack targeting developers who may mistype the legitimate 'typescript' package name. The package contains no actual library functionality—its index.js is an empty object.
The malicious behavior is triggered by scripts/postinstall.js, which runs automatically during npm install. The script XOR-decodes (using key 'stf2026') a hardcoded payload URL and C2 host address (193.70.34.101). It then POSTs a host-fingerprint JSON body to http://193.70.34.101:20099/vote and downloads a Windows PE executable to %TEMP%\main.exe, spawning it with detached stdio and hidden window.
When executed under WSL, the script decodes and executes a separate PowerShell 'bridge' command to fetch and launch the same binary on the Windows host. All sensitive strings—payload URL, PowerShell invocation, and script fragments—are shipped as XOR-encoded byte arrays and decoded at runtime to evade detection.
The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- typesript-core
- IPs
- 193.70.34.101
Remediation
- Review the linked advisory; remove or upgrade the affected component and rotate any exposed credentials.
Sources
- GitHub Advisory GHSA-hw78-gxc6-g92v · GitHub Advisory Database
Cite this entry
"Malicious code in typesript-core (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-typesript-core-npm-160sen
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package