MAL-2026-14144

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f2ba91f9b227b017ddbfa6a908a0a8f0263292a0af2c11aeef0ccd24b2894862) Package name 'tyepescript-core' is a typosquat of 'typescript'; the module itself exports an empty stub. scripts/postinstall.js XOR-decodes byte arrays (key 'stf2026') to reconstruct a download URL and shell command at runtime, fetches an opaque Windows binary to %TEMP%\main.exe, and spawns it detached with stdio ignored. On WSL/virtualized-Linux hosts, a second XOR-decoded 'bridge' command is passed to child_process.exec to reach the Windows host. The same postinstall also POSTs a JSON body containing the resolved platform label to http://193.70.34.101:20099/vote, with the bare-IP host assembled at runtime from a string array to hide the literal. Result: arbitrary attacker-controlled code execution on the installer's machine at 'npm install' time, plus an install beacon to attacker infrastructure.