MAL-2026-14155

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/typesript-core/MAL-2026-14155.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14155
Published
2026-08-18T23:21:12Z
Modified
2026-08-18T23:45:12.917202530Z
Summary
Malicious code in typesript-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e8b6f2a112a6a6d3b065b205c4cbb1d8183340054a2d57d7697360e30dbdccd9)

typesript-core@1.0.0 is a typosquat of 'typescript' whose index.js is an empty object; the package has no library functionality. Its only behavior is scripts/postinstall.js, which runs automatically on npm install. The script XOR-decodes (key 'stf2026') a hardcoded payload URL, array-joins the C2 host 193.70.34.101 to hide the literal IP, POSTs a host-fingerprint JSON body ({platform: label}) to http://193.70.34.101:20099/vote, then downloads a Windows PE to %TEMP%\main.exe and spawns it detached with stdio ignored and windowsHide set. When run under WSL, a separately XOR-decoded PowerShell 'bridge' command is exec'd to fetch and launch the same binary on the Windows host. Payload URL, PowerShell bridge invocation, and pre/post script fragments are all shipped as XOR-encoded byte arrays and decoded at runtime.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-18T23:41:22.483518719Z",
            "sha256": "e8b6f2a112a6a6d3b065b205c4cbb1d8183340054a2d57d7697360e30dbdccd9",
            "modified_time": "2026-08-18T23:21:12Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018191",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / typesript-core

Package

Name
typesript-core
View open source insights on deps.dev
Purl
pkg:npm/typesript-core

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/typesript-core/MAL-2026-14155.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "f023a1df6dae37f7c747aa5359fce6618875033912e21a176b8a9dbe0d0fe362",
            "tlsh": "3ed13ec61ef59035874bf96884cf9d13b2a6c207330e4a65fb8f42107f5792c85a69ea",
            "path": "scripts/postinstall.js"
        },
        {
            "sha256": "ac13991093efce1485ecbfa7fa9fa75895e04161fd015d3699fbd07179e829ec",
            "path": "index.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "typesript-core-1.0.0.tgz",
            "hashes": {
                "sha1": "1aa538be8cd688c9d5622b320a22bd8f72617c85",
                "sha512_sri": "sha512-kgQ/mEE/ngYza1IFtVQRhbwUZshp8qptAt9WXZ0uX77ch5/3SZQ2g8qWZyw6VbuDQqbwA1FVoRH/h/0bxiutww=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]