MAL-2026-14157

    Dashboard / Malicious Package / MAL-2026-14157

    MAL-2026-14157

    Published: 18 Aug 2026Last Modified: 18 Aug 2026

    Summary: Malicious code in typscript-core (npm)

    Details: Source: amazon-inspector (5120bfde64344d0e161bac3b4128d7eeecc483ad796361db09eacd138ecd3945) typscript-core is a typosquat of the 'typescript' package. Its scripts/postinstall.js reconstructs a GitHub download URL and shell commands from byte arrays XOR-decoded with the key 'stf2026', downloads a binary to %TEMP%\main.exe, and spawns it detached with windowsHide:true on win32 (and via a PowerShell bridge on WSL). The same postinstall also POSTs platform information to a hardcoded bare-IP endpoint at http://193.70.34.101:20099/vote, with the IP assembled from a four-element string array to evade static search. The URLs, shell commands, and destination IP are all obfuscated and reconstructed at runtime.

    References: https://www.npmjs.com/package/typscript-core/v/1.0.0

    Affected packages

    Package

    Name: typscript-core

    Purl: pkg:npm/typscript-core

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-14157 | CVE-DB