The malicious 'typecript-cli' npm package (version 1.0.0) is a typosquatting attack targeting users who intend to install the legitimate 'typescript' package. Its postinstall.js script contains obfuscated payload strings stored as integer arrays, decoded at runtime using XOR with the key 'stf2026'. This script downloads an unsigned executable 'main.exe' from a personal GitHub account unrelated to the package publisher and executes it detached on Windows hosts without hash or signature verification. When installed under WSL, the script uses an exec() bridge to invoke PowerShell on the Windows host, escaping the Linux sandbox to run the payload. Additionally, the script sends a JSON POST request containing the resolved platform label to a hardcoded IP address (193.70.34.101) assembled from split octets to evade static detection. This beacon likely serves as an install confirmation and host selector for further malicious activity.

Users installing 'typecript-cli' version 1.0.0 risk executing arbitrary unsigned code on their Windows systems, potentially leading to full system compromise. The payload is delivered stealthily during package installation and bypasses common static detection methods through obfuscation. The beaconing behavior indicates possible remote control or further payload delivery. The ability to escape WSL sandboxing increases the attack surface on Windows systems running Linux environments.

No official patch or remediation is currently documented. Users should avoid installing 'typecript-cli' version 1.0.0 and verify package names carefully to prevent typosquatting attacks. Use only trusted sources and official package names when installing npm packages. Monitor for updates from the npm registry or security advisories for any official fixes or removals. Since this is a malicious package, removal of the package and any downloaded payloads is recommended if installed.