The 'typescrip-cli' npm package (version 1.0.0) is a malicious typosquatting package that mimics the legitimate 'typescript-cli' package. Its index.js exports an empty object, providing no library functionality. The postinstall.js script contains obfuscated network destinations encoded as XOR byte arrays with the key 'stf2026'. At runtime, it decodes a URL pointing to a Windows executable hosted on a personal GitHub account under a mutable 'null' release tag. On Windows systems, the script downloads this executable to the temporary directory and executes it detached. On WSL or virtualized Linux, it decodes and runs a PowerShell launcher that bridges execution to the Windows host. Concurrently, the script sends a JSON POST request identifying the host platform to a hardcoded IP address (193.70.34.101) to avoid detection by splitting the IP string. This behavior indicates a deliberate attempt to execute malicious code and exfiltrate system information.

This malicious package can lead to arbitrary code execution on Windows hosts, including those running WSL or virtualized Linux environments. The downloaded executable's functionality is not detailed but the execution of unknown code from an untrusted source poses risks such as system compromise, data theft, or persistence. The beaconing to a hardcoded IP address also indicates potential information leakage about infected hosts.

No official patch or remediation is available as this is a malicious package rather than a vulnerability in legitimate software. The recommended mitigation is to avoid installing 'typescrip-cli' version 1.0.0 and instead use the legitimate 'typescript-cli' package. Security teams should audit dependencies for typosquatting packages and remove any instances of 'typescrip-cli'. Monitoring for downloads from suspicious URLs and blocking communication to the hardcoded IP address may help reduce risk.