MAL-2026-14151

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/typescriptt-cli/MAL-2026-14151.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14151
Published
2026-08-18T23:20:22Z
Modified
2026-08-18T23:45:11Z
Summary
Malicious code in typescriptt-cli (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (023f754538f603fbb5379ee8be82cb9524f710495e5dddc4e631e5aafbf323b5)

typescriptt-cli is a typosquat of typescript-cli whose index.js is an empty module; its only real behavior is in scripts/postinstall.js. On npm install, the postinstall script XOR-decodes a hardcoded byte array with key 'stf2026' to reconstruct a URL pointing at github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe, downloads that Windows executable to %TEMP%\main.exe, and spawns it detached with windowsHide:true and stdio:'ignore'. When the host is WSL (detected by scanning /proc/version and /proc/sys/kernel/osrelease for 'microsoft'), the script assembles a powershell.exe command from three additional XOR-obfuscated byte arrays and passes it to child_process.exec to fetch and run the same binary on the Windows host, breaking out of the WSL boundary. Before the drop, the script POSTs a JSON platform label to a hardcoded bare-IP install-tracking endpoint at http://193.70.34.101:20099/vote. The download URL uses a personal GitHub account with the release tag literally 'null', no hash or signature verification is performed, and the executable payload is opaque.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018185",
            "import_time": "2026-08-18T23:41:21.966609459Z",
            "modified_time": "2026-08-18T23:20:22Z",
            "sha256": "023f754538f603fbb5379ee8be82cb9524f710495e5dddc4e631e5aafbf323b5",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / typescriptt-cli

Package

Name
typescriptt-cli
View open source insights on deps.dev
Purl
pkg:npm/typescriptt-cli

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "scripts/postinstall.js",
            "sha256": "9c81289ea095aa745f5d06b9533c9f28df4b746dc445cec227f99dbeb1b2672e",
            "tlsh": "00d13fca1ef59035874bf96884cf9d13b2a6c207320e4a65ff8f42107f5793c85a69e9"
        }
    ],
    "package_integrity": [
        {
            "filename": "typescriptt-cli-1.0.0.tgz",
            "hashes": {
                "sha1": "84bbe977113c01c09f65996ba8accd4e275628dd",
                "sha512_sri": "sha512-0hCqGG2Dcj5JqLbJ+WCP3Z6CwDEqz8n0XfZaCLfWq+4Re7xDPNLpnxVKuNj3hFE9430WJsF4zScrvDXp223jQg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/typescriptt-cli/MAL-2026-14151.json"