Malicious code in typscript-cli (npm)
typscript-cli is a typosquat package on npm containing malicious postinstall code that downloads and executes a Windows executable on installation. The payload is obfuscated via XOR encoding and exfiltrates platform information to a hardcoded IP endpoint.
- Disclosed
- Last updated
- Blast radius
- Any developer or system installing typscript-cli from npm; Windows systems and WSL/Linux hosts with Windows subsystems are directly targeted.
- Ecosystems
- Attack vectors
- Affected entities
- typscript-cliTyposquat of 'typescript' package; malicious postinstall script downloads and executes Windows executable
typscript-cli is a typosquat of the legitimate 'typescript' package published to npm. The package exports an empty object and contains no functional library code; its only active component is a malicious postinstall script (scripts/postinstall.js) that executes automatically on npm install.
The postinstall script uses XOR decoding (key 'stf2026') to obfuscate four embedded numeric arrays, reconstructing a download URL and a PowerShell bridge command. It downloads a Windows executable to %TEMP%\main.exe and spawns it detached with windowsHide:true to hide execution. On WSL/Linux hosts, the script uses child_process.exec to invoke the XOR-decoded PowerShell command, allowing the payload to be dropped and executed on the Windows side.
The script also exfiltrates platform information by POSTing a platform label to the hardcoded bare-IP endpoint 193.70.34.101:20099/vote over plain HTTP. The IP address is assembled from a split array to evade literal-string scanning. There is no publisher-matched destination, no version pinning, and no integrity verification on the fetched binary, maximizing the attack surface.
This incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- typscript-cli
- IPs
- 193.70.34.101
Remediation
- Immediately uninstall typscript-cli from all systems: npm uninstall typscript-cli
- Audit npm install logs and package-lock.json for any installation of typscript-cli
- Scan systems that installed typscript-cli for the presence of %TEMP%\main.exe or related artifacts
- Review outbound network connections to 193.70.34.101:20099 in firewall and proxy logs
- Use the correct package name 'typescript' (not 'typscript-cli') for future installations
- Enable npm audit and consider using npm ci with locked dependencies to prevent typosquat installation
- Monitor for similar typosquats of popular packages (e.g., 'typscript-*', 'type-script-*')
Sources
- GitHub Advisory GHSA-9x3x-fm83-hjg6 · GitHub Advisory Database
Cite this entry
"Malicious code in typscript-cli (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-typscript-cli-npm-eyilay
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package