The 'typesript-core' package at version 1.0.0 is a malicious typosquat of the legitimate 'typescript' npm package. Its index.js exports an empty object, providing no functionality. The package's postinstall script runs automatically upon installation, XOR-decodes a hardcoded payload URL and a PowerShell bridge command, and contacts a C2 server at IP 193.70.34.101 on port 20099 by POSTing a JSON host fingerprint. It then downloads a Windows PE executable to the %TEMP% directory as 'main.exe' and executes it detached and hidden. Under WSL, it executes a PowerShell command to launch the same payload on the Windows host. All payload URLs and commands are obfuscated with XOR encoding to evade detection.

This package enables remote code execution on the host machine by downloading and executing a malicious Windows executable from a remote server. It can compromise Windows systems, including those running WSL, by silently executing malware. The malicious behavior occurs automatically upon npm install, potentially leading to system compromise without user awareness.

Avoid installing the 'typesript-core' package, as it is a malicious typosquat. Remove any installations of this package immediately. Since no official patch or fix exists, users should rely on package name verification and use trusted sources. Employ npm security tools to detect and block typosquatting packages. Monitor for and remove any downloaded payloads such as '%TEMP%\main.exe'.