MAL-2026-14156
Malicious code in typscript-cli (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (1425e6f0bb2305eeddecaab5403e09ead0e8f60b9b1f817581a343cb5a3dd062) typscript-cli is a typosquat of 'typescript' (index.js exports an empty object; no library functionality). Its scripts/postinstall.js is the only functional code and executes on npm install. It XOR-decodes (key 'stf2026') four embedded numeric arrays to reconstruct a download URL and a PowerShell 'bridge' command, downloads a Windows executable to %TEMP%\main.exe, and spawns it detached with windowsHide:true. On WSL/Linux hosts it uses child_process.exec with the XOR-decoded PowerShell bridge command to drop and run the same payload on the Windows side. The same postinstall also POSTs a platform label to a hardcoded bare-IP endpoint 193.70.34.101:20099/vote over plain HTTP, with the host assembled from a split array ['193','70','34','101'].join('.') to evade literal-string scanning. There is no publisher-matched destination, no version pinning, and no integrity check on the fetched binary.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for typscript-cli (npm). Pin to a known-safe version or switch to an alternative.