The 'tyepescript-core' npm package (version 1.0.0) is a typosquatting malicious package designed to execute attacker-controlled code during installation. Its postinstall.js script XOR-decodes byte arrays to reconstruct a download URL and shell command, downloads an opaque Windows binary to %TEMP%\main.exe, and executes it detached with ignored stdio. On WSL or virtualized Linux hosts, it executes an additional XOR-decoded 'bridge' command to interact with the Windows host. The package also sends a JSON POST request containing the resolved platform label to an attacker-controlled IP address assembled at runtime to evade detection. This behavior enables arbitrary code execution on the installer's machine at install time and establishes a beacon to attacker infrastructure.

This package enables arbitrary attacker-controlled code execution on the machine where 'npm install' is run, potentially compromising the system. The beaconing behavior also leaks platform information to the attacker. The malicious payload targets Windows environments and attempts to bridge to Windows hosts from WSL or virtualized Linux environments, increasing the attack surface.

No official patch or remediation is currently documented. Users should avoid installing the 'tyepescript-core' package and verify package names carefully to prevent typosquatting attacks. Use trusted package sources and consider implementing package name allowlists or scanning tools to detect malicious packages. Monitor for suspicious post-install scripts in npm packages.