The 'tyepescript-cli' npm package (version 1.0.0) is a malicious typosquatting package that executes harmful actions during installation. Its 'scripts/postinstall.js' script XOR-decodes obfuscated byte arrays to reveal attacker-controlled URLs and PowerShell commands. On Windows, it downloads 'main.exe' from a non-legitimate GitHub repository and executes it detached in the temporary directory. When installed under WSL, it executes a PowerShell bridge command to run the same binary on the Windows host. Additionally, it sends a JSON beacon with host information to a hardcoded numeric IP address. The use of obfuscation and the unrelated GitHub release path confirm the malicious intent of this package.

Systems that install 'tyepescript-cli' version 1.0.0 risk executing attacker-controlled binaries and commands, potentially leading to system compromise. The malicious binary is downloaded and executed without user consent, and the package also communicates with a remote server, possibly for command and control or data exfiltration. This can result in unauthorized code execution and loss of system integrity on affected Windows hosts, including those running WSL.

Users and organizations should avoid installing the 'tyepescript-cli' package, as it is a malicious typosquat of the legitimate 'typescript' package. There is no official patch or fix since this is a malicious package rather than a vulnerability in legitimate software. Security teams should audit their dependency trees to ensure this package is not present and remove it if found. Use trusted package sources and verify package names carefully to prevent typosquatting attacks.