MAL-2026-14144

    Dashboard / Malicious Package / MAL-2026-14144

    MAL-2026-14144

    Published: 18 Aug 2026Last Modified: 18 Aug 2026

    Summary: Malicious code in tyepescript-core (npm)

    Details: Source: amazon-inspector (f2ba91f9b227b017ddbfa6a908a0a8f0263292a0af2c11aeef0ccd24b2894862) Package name 'tyepescript-core' is a typosquat of 'typescript'; the module itself exports an empty stub. scripts/postinstall.js XOR-decodes byte arrays (key 'stf2026') to reconstruct a download URL and shell command at runtime, fetches an opaque Windows binary to %TEMP%\main.exe, and spawns it detached with stdio ignored. On WSL/virtualized-Linux hosts, a second XOR-decoded 'bridge' command is passed to child_process.exec to reach the Windows host. The same postinstall also POSTs a JSON body containing the resolved platform label to http://193.70.34.101:20099/vote, with the bare-IP host assembled at runtime from a string array to hide the literal. Result: arbitrary attacker-controlled code execution on the installer's machine at 'npm install' time, plus an install beacon to attacker infrastructure.

    References: https://www.npmjs.com/package/tyepescript-core/v/1.0.0

    Affected packages

    Package

    Name: tyepescript-core

    Purl: pkg:npm/tyepescript-core

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-14144 | CVE-DB