The typescriptt-core package is a malicious typosquat targeting npm users who mistakenly install it instead of the legitimate TypeScript package. It exports an empty module but executes a postinstall script that XOR-decodes a URL and PowerShell launcher using a fixed key. On Windows systems, it downloads a file named main.exe from a GitHub repository unrelated to TypeScript and executes it detached in the temporary directory. On WSL, it uses a decoded bridge command to invoke PowerShell on the Windows host to perform the same download and execution. Before dropping the payload, it sends a JSON payload containing the host platform label to a hardcoded IP address via HTTP as an install beacon. The obfuscation of URLs and commands is intended to bypass static code reviews and detection.

This malicious package can lead to arbitrary code execution on affected Windows hosts by downloading and running an unknown executable from an attacker-controlled GitHub repository. The beaconing behavior leaks host platform information to a remote server. The overall impact includes potential system compromise, data exfiltration, or further malware deployment. There is no indication of active exploitation in the wild at this time.

No official patch or remediation is available since this is a malicious typosquat package rather than a vulnerability in legitimate software. Users should avoid installing packages with suspicious or misspelled names. Use trusted sources and verify package authenticity before installation. Remove the typescriptt-core package if installed. Monitor for any unexpected network connections to the indicated IP or GitHub URLs. Consider blocking the malicious domains and IPs at the network level.