The 'typescipt-core' npm package (version 1.0.0) is a typosquatting malicious package targeting users who mistakenly install it instead of 'typescript'. Its postinstall script XOR-decodes a download URL and a PowerShell launcher using a static key. On Windows, it downloads an executable to the temporary directory and runs it detached. On Windows Subsystem for Linux (WSL), it executes a PowerShell bridge script. Before the second stage download, it sends a JSON host profile containing Windows or WSL labels derived from system files to a hardcoded IP address (193.70.34.101) over plain HTTP. The network destinations and commands are stored as XOR-encoded byte arrays and reconstructed at runtime. This install-time dropper enables remote attacker code execution on the host.

Successful installation of this package results in arbitrary code execution on the victim's machine, potentially allowing attackers to run malicious payloads, gather system information, and maintain persistence. The exfiltration of host profile data to a remote server may facilitate targeted follow-up attacks or reconnaissance.

No official patch or remediation is available as this is a malicious typosquatting package. Users should avoid installing 'typescipt-core' and verify package names carefully before installation. Use trusted sources and package registries with verified publishers. Consider scanning installed packages for known malicious code and remove any instances of this package immediately.