The typscript-cli package is a typosquat of the legitimate 'typescript' npm package. Its only functional code is in scripts/postinstall.js, which runs on npm install. This script XOR-decodes four embedded numeric arrays using the key 'stf2026' to reconstruct a download URL and a PowerShell command. It downloads a Windows executable to the user's %TEMP% directory and executes it detached and hidden. On WSL/Linux hosts, it uses a PowerShell bridge command to run the payload on the Windows side. Additionally, the script sends a platform label via an HTTP POST request to a hardcoded IP address (193.70.34.101:20099/vote), with the IP assembled dynamically to evade detection. There is no publisher verification, version pinning, or integrity check on the downloaded payload, making this a supply chain malware threat. The affected version is 1.0.0.

This malicious package can execute arbitrary Windows executables on the victim's machine during npm install, potentially leading to full system compromise or persistence. The payload is downloaded and executed without integrity checks, increasing risk of undetected malware infection. The exfiltration of platform information to a remote server indicates potential for further targeted attacks or data collection. The threat affects users who mistakenly install this typosquatted package instead of the legitimate 'typescript' package.

Users should avoid installing the typscript-cli package and verify package names carefully to prevent typosquatting attacks. Since no official fix or patch is available, the best mitigation is to remove any installations of typscript-cli version 1.0.0 and scan affected systems for the downloaded payload. Use trusted package sources and enable npm package integrity checks where possible. Monitor for suspicious network activity to the IP 193.70.34.101 and block it if detected.