MAL-2026-14155
Dashboard / Malicious Package / MAL-2026-14155
MAL-2026-14155
Summary: Malicious code in typesript-core (npm)
Details: Source: amazon-inspector (e8b6f2a112a6a6d3b065b205c4cbb1d8183340054a2d57d7697360e30dbdccd9) [email protected] is a typosquat of 'typescript' whose index.js is an empty object; the package has no library functionality. Its only behavior is scripts/postinstall.js, which runs automatically on npm install. The script XOR-decodes (key 'stf2026') a hardcoded payload URL, array-joins the C2 host 193.70.34.101 to hide the literal IP, POSTs a host-fingerprint JSON body ({platform: label}) to http://193.70.34.101:20099/vote, then downloads a Windows PE to %TEMP%\main.exe and spawns it detached with stdio ignored and windowsHide set. When run under WSL, a separately XOR-decoded PowerShell 'bridge' command is exec'd to fetch and launch the same binary on the Windows host. Payload URL, PowerShell bridge invocation, and pre/post script fragments are all shipped as XOR-encoded byte arrays and decoded at runtime.
Affected packages
Package
Name: typesript-core
Purl: pkg:npm/typesript-core
Affected ranges
Type: N/A
Events:
