The 'typescrit-cli' npm package version 1.0.0 includes a post-install script that XOR-decodes a URL pointing to a personal GitHub repository, downloads an executable payload to %TEMP%\main.exe, and runs it detached with no visible window or standard IO. It detects WSL environments by checking Linux kernel version files and uses an XOR-decoded PowerShell command to escape the container and execute the payload on the Windows host. The script also sends a JSON payload containing platform details to a hardcoded IP address (193.70.34.101) on port 20099, with the IP address assembled at runtime to evade detection. All network destinations and command fragments are stored as byte arrays and decoded at runtime. The package name is a typo-squatting attempt on 'typescript-cli' and the publisher is unrelated to the GitHub account hosting the payload.

Installation of this package results in execution of a malicious payload on the host system, potentially compromising the system by running unauthorized code. The payload is downloaded and executed without user consent, and the malware attempts to persist by escaping WSL environments to infect the Windows host. It also communicates with a remote command-and-control server, potentially allowing remote attackers to control or exfiltrate data from the infected system.

No official patch or fix is currently available. Users should avoid installing the 'typescrit-cli' package version 1.0.0. Verify package names carefully to avoid typo-squatting attacks. Remove any installations of this package and scan affected systems for the downloaded payload (%TEMP%\main.exe). Monitor for suspicious network connections to the IP 193.70.34.101 on port 20099. Check vendor advisories or npm security advisories for updates or remediation guidance.