Malicious code in typscript-core (npm)

The typscript-core package (version 1.0.0) is a typosquatting malicious npm package that mimics the legitimate 'typescript' package name. Its postinstall.js script reconstructs a GitHub download URL and shell commands by XOR-decoding byte arrays with the key 'stf2026'. It downloads a binary to the %TEMP%\main.exe path and executes it detached with windowsHide:true on Windows, or via a PowerShell bridge on Windows Subsystem for Linux (WSL). Additionally, it sends platform information via an HTTP POST request to a hardcoded IP address (http://193.70.34.101:20099/vote), with the IP address obfuscated as a four-element string array to evade static detection. The URLs, commands, and destination IP are all obfuscated and reconstructed at runtime to avoid detection.

Installation of this package results in the execution of a downloaded binary on the victim's machine, which could lead to unauthorized code execution, potential system compromise, and data exfiltration through the POST request to the attacker-controlled IP. The obfuscation and runtime reconstruction of commands increase the difficulty of detection and analysis.

Users should avoid installing the typscript-core package, as it is a malicious typosquat of the legitimate 'typescript' package. Since no patch or official fix exists, remediation involves removing this package if installed and verifying the integrity of dependencies. Use trusted package names and verify package authenticity before installation. Monitor for any unexpected network connections to the indicated IP address. Patch status is not yet confirmed — check vendor advisories or npm security notices for updates.