MAL-2026-14153

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/typescrit-cli/MAL-2026-14153.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14153
Published
2026-08-18T23:21:03Z
Modified
2026-08-18T23:45:11Z
Summary
Malicious code in typescrit-cli (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (adcb90c6a48b3b20928967d1aea32cde54035ed455c474a6db4fab148b424b53)

On npm install, scripts/postinstall.js XOR-decodes (key 'stf2026') a hidden URL that resolves to an unrelated personal GitHub account (github.com/bebra1/...), downloads a payload to %TEMP%\main.exe, and spawns it detached with stdio ignored and window hidden. When the host is detected as WSL (via /proc/version, /proc/sys/kernel/osrelease, WSL_DISTRO_NAME), the script assembles an XOR-decoded powershell.exe bridge command and exec()s it to escape the Linux container and run the same payload on the Windows host. The same postinstall also POSTs a JSON body containing the platform to a hardcoded bare-IP C2 at http://193.70.34.101:20099/vote, with the IP assembled from a split array (['193','70','34','101'].join('.')) to evade literal-URL detection. All network destinations and shell command fragments (addon URL, powershell launcher, bridge script fragments) are stored as byte arrays and XOR-decoded at runtime. The package name resembles a mistyped 'typescript-cli' and the publisher is unrelated to the GitHub account hosting the payload.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018190",
            "import_time": "2026-08-18T23:41:22.381392618Z",
            "modified_time": "2026-08-18T23:21:03Z",
            "sha256": "adcb90c6a48b3b20928967d1aea32cde54035ed455c474a6db4fab148b424b53",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / typescrit-cli

Package

Name
typescrit-cli
View open source insights on deps.dev
Purl
pkg:npm/typescrit-cli

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "scripts/postinstall.js",
            "sha256": "e19ac3004d924f2294d27f5671e98793f8e92babdff33f95d6f2e643fcc03dca",
            "tlsh": "5fd13fca1ef59035874bf96884cf9d13b2a6c207320e4a65ff8f42107f5793c85a69e9"
        }
    ],
    "package_integrity": [
        {
            "filename": "typescrit-cli-1.0.0.tgz",
            "hashes": {
                "sha1": "8aed52b60061191051c4979c91aa29bddb02e898",
                "sha512_sri": "sha512-/CqdMFG+y+4B5WvXTYt7FxhQdr2oqwu+/c5TJfyNyzMcejq4SIJHl0juzu7LwfGZdc1AEY/NzXXok9ojbeJ5kA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/typescrit-cli/MAL-2026-14153.json"