The typescipt-cli package (version 1.0.0) is a typosquatting malicious npm package targeting users who mistakenly install it instead of the legitimate 'typescript' package. Its postinstall script performs three main malicious actions: (1) it sends a JSON payload containing the installer's platform label to a remote IP address (193.70.34.101) on port 20099, obfuscated by splitting the IP into a string array; (2) it XOR-decodes a hardcoded URL pointing to a binary executable hosted on GitHub, downloads this binary to the Windows temporary directory as 'main.exe', and launches it in a hidden detached process without any hash or signature verification; (3) on Windows Subsystem for Linux (WSL), it decodes and executes a PowerShell bridge command to perform the same download and execution on the host Windows system. All URLs, commands, and the C2 IP are stored as encoded byte arrays and reconstructed at runtime to avoid detection.

Successful installation of this package results in execution of a potentially malicious binary on the victim's Windows system without user consent or verification. This can lead to unauthorized remote code execution, potential system compromise, and data exfiltration. The attacker gains control via a command-and-control server, with no integrity checks on the downloaded payload, increasing risk of persistent compromise.

Users should avoid installing the 'typescipt-cli' package, as it is a known typosquatting malicious package. Remove any installations of version 1.0.0 immediately. Since no official fix or patch is available, remediation involves uninstalling the package and scanning affected systems for the downloaded payload and any signs of compromise. Monitor for and block network connections to the IP 193.70.34.101 and the GitHub URL hosting the malicious binary. Exercise caution when installing similarly named packages and verify package authenticity before installation.