The 'typesript-cli' package is a one-character typo-squatted malicious npm package impersonating the legitimate 'typescript' package. Its post-install script XOR-decodes a GitHub-hosted payload and downloads a Windows PE executable to TEMP\main.exe, which it executes without signature verification. When detected running under Windows Subsystem for Linux (WSL) or virtualized Linux, it further decodes and executes a bridge launcher command to run the payload on the Windows host, effectively crossing sandbox boundaries. The script also exfiltrates platform information to a hardcoded IP address (193.70.34.101) by reconstructing the IP from a string array to evade static detection. This behavior indicates a targeted attempt to infect Windows systems via npm package installation.

Installation of this package results in execution of an unverified Windows executable, potentially leading to system compromise. The payload crosses sandbox boundaries when run under WSL or virtualized Linux, increasing the attack surface. The beaconing to a hardcoded IP address reveals installation and environment details to an attacker-controlled server, facilitating further malicious activity or tracking. No known exploits in the wild are reported yet, but the malicious behavior poses a high risk to affected systems.

No official patch or fix is available since this is a malicious package rather than a vulnerability in legitimate software. Users should avoid installing 'typesript-cli' and verify package names carefully before installation. Remove the package if already installed and scan affected systems for the downloaded payload (TEMP\main.exe). Network monitoring or blocking connections to the IP 193.70.34.101 may help detect or prevent beaconing. Use trusted sources and package integrity verification to prevent typosquatting attacks.