MAL-2026-14146

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/typescipt-cli/MAL-2026-14146.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14146
Published
2026-08-18T23:19:49Z
Modified
2026-08-18T23:45:12.927060058Z
Summary
Malicious code in typescipt-cli (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b080f58ace02e860729134afd887943345248628e5c201a5fd2e46c71f439d29)

Package name typosquats 'typescript'. scripts/postinstall.js runs at npm install time and: (1) POSTs a JSON body with the installer's platform label to 193.70.34.101:20099/vote, with the IP split into a string array ['193','70','34','101'].join('.') to obscure it; (2) XOR-decodes a hardcoded URL (github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe) using key 'stf2026' via a byte-array unpackSegment helper, downloads the resulting binary to %TEMP%\main.exe on Windows, and launches it detached with windowsHide; (3) on WSL, XOR-decodes a PowerShell bridge command and exec's it to run the same download on the host Windows. No hash or signature verification. URLs, commands, and the C2 IP are stored as encoded byte arrays and reconstructed at runtime.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-18T23:41:21.656838248Z",
            "sha256": "b080f58ace02e860729134afd887943345248628e5c201a5fd2e46c71f439d29",
            "modified_time": "2026-08-18T23:19:49Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018181",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / typescipt-cli

Package

Name
typescipt-cli
View open source insights on deps.dev
Purl
pkg:npm/typescipt-cli

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/typescipt-cli/MAL-2026-14146.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "6babc7ff9d59bd723dc8c469cdfa82a6bc75ec1b10e94eba618828969d438357",
            "path": "scripts/postinstall.js",
            "tlsh": "d7d13fca1ef59035874bf96884cf9d13b2a6c207320e4a65ff8f42107f5793c85a69e9"
        }
    ],
    "package_integrity": [
        {
            "filename": "typescipt-cli-1.0.0.tgz",
            "hashes": {
                "sha1": "9fd63721313661c0d19e0402593bd7ac3358d06a",
                "sha512_sri": "sha512-YD9ZUOZg9PWAAS/sD5pIf7PogwzHNm+gbuy1QGr64Dp6ksx4FhkWMv3TjZDRP1OBLf8hwXe7PtNUpHmZJanbGw=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]