MAL-2026-14152

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/typescriptt-core/MAL-2026-14152.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14152
Published
2026-08-18T23:20:55Z
Modified
2026-08-18T23:45:11.535701801Z
Summary
Malicious code in typescriptt-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b701541fd1cac460b8ab9a3e24dd1d0e476965e4d247826f5108e4a8eb6996d8)

typescriptt-core is a typosquat of the TypeScript ecosystem (double-t) with an empty main (module.exports = {}) and no library functionality. The only code that runs is scripts/postinstall.js, which XOR-decodes a hidden URL and PowerShell launcher using the fixed key 'stf2026' and, on Windows, downloads main.exe from https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe to %TEMP% and spawns it detached. On WSL, the same script decodes a bridge command and invokes powershell.exe on the Windows host to perform the same fetch-and-run. Before the drop, postinstall POSTs a small JSON payload containing the host platform label to a hardcoded bare-IP endpoint http://193.70.34.101:20099/vote over plain HTTP as an install beacon. The destination GitHub account (bebraz1) is unrelated to the TypeScript project, the payload is opaque, and both the URL and the PowerShell command are XOR-obfuscated to defeat static review.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-18T23:41:22.322752081Z",
            "sha256": "b701541fd1cac460b8ab9a3e24dd1d0e476965e4d247826f5108e4a8eb6996d8",
            "modified_time": "2026-08-18T23:20:55Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018189",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / typescriptt-core

Package

Name
typescriptt-core
View open source insights on deps.dev
Purl
pkg:npm/typescriptt-core

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/typescriptt-core/MAL-2026-14152.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "501f55031e612035020ef78940d5dc8ae7e740511c18a3a5270bf2b8b9c24074",
            "path": "scripts/postinstall.js",
            "tlsh": "d6d130c61ef5a035874bf96884cf9d13b2a6c207330e4a65ff8f42107f5792c85a69d6"
        },
        {
            "sha256": "3bb5cd22309f8a0f45b678853b177e8217e712d2392c16cf2fab35ba59347b7c",
            "tlsh": "ffd022000d22ca3328c45ba54e33c509a6714d2f0044fc0827d31028c3ea7ba0cfe30e",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "typescriptt-core-1.0.0.tgz",
            "hashes": {
                "sha1": "00380a8a11b687bc4b26b6ffcf2dddea3da4b56e",
                "sha512_sri": "sha512-PxLw2JJiMD67JVfC4U7pdaosIT4MyKtipdx8lxed5Ayzs2iJoFCZhDgh8nTtc/9zZVhHq9wfvD0pp7rVlnIZ+g=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]