The 'typescirpt-core' package is a malicious npm package designed to impersonate the legitimate 'typescript' package via typosquatting. Its postinstall.js script automatically runs on npm install, sending a JSON beacon to a hardcoded IP endpoint (http://193.70.34.101:20099/vote). It decodes an embedded integer array using XOR with key 'stf2026' to reconstruct a URL from which it downloads a Windows executable to %TEMP%/main.exe and executes it detached and hidden. Additionally, it detects if running under Windows Subsystem for Linux (WSL) and uses XOR-decoded PowerShell scripts to pivot execution back to the Windows host environment. The use of XOR encoding for URLs and commands is intended to evade static analysis and detection.

Installation of this package results in silent execution of a remote Windows executable, potentially leading to system compromise. The package also exfiltrates information via a beacon to a remote IP. The WSL detection and pivoting capability allow the malware to bypass Linux environment isolation and execute on the Windows host. This behavior can lead to unauthorized code execution, data exfiltration, and persistence on affected systems.

Avoid installing the 'typescirpt-core' package, as it is a malicious typosquat of 'typescript'. There is no official patch or fix since this is a malicious package rather than a vulnerability in legitimate software. Users should verify package names carefully before installation and rely on official package sources. Remove any installations of 'typescirpt-core' immediately and scan affected systems for the downloaded payload and related artifacts.