The typescriptt-cli package is a typosquat of typescript-cli. Its index.js is empty, but its postinstall.js script XOR-decodes a hardcoded byte array to reconstruct a URL pointing to a GitHub release hosting a Windows executable. Upon npm install, it downloads this executable to the %TEMP% directory and runs it detached and hidden. If running under WSL, it detects this environment and executes a PowerShell command to run the same payload on the Windows host, effectively escaping the WSL sandbox. Before downloading, it sends a JSON platform label to a hardcoded IP address for install tracking. The payload is unsigned and opaque, and no hash or signature verification is performed. The affected version is exactly 1.0.0.

This malicious package can execute arbitrary code on the host system during installation, potentially leading to full compromise of the Windows environment. The WSL breakout capability increases the attack surface by allowing execution on the Windows host from a Linux subsystem. The lack of payload verification and use of a personal GitHub account for hosting increases risk of undetected malicious activity. The tracking POST request reveals installation to an attacker-controlled server.

Users should avoid installing the typescriptt-cli package, especially version 1.0.0. Since this is a malicious typosquat package, the best mitigation is to verify package names carefully before installation. There is no official patch or fix as this is a malicious package rather than a vulnerability in legitimate software. Remove any installations of typescriptt-cli 1.0.0 and scan affected systems for the downloaded payload. Monitor for suspicious network activity to the hardcoded IP and GitHub URLs.