MAL-2026-14157

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/typscript-core/MAL-2026-14157.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14157
Published
2026-08-18T23:21:45Z
Modified
2026-08-18T23:45:12.867374756Z
Summary
Malicious code in typscript-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5120bfde64344d0e161bac3b4128d7eeecc483ad796361db09eacd138ecd3945)

typscript-core is a typosquat of the 'typescript' package. Its scripts/postinstall.js reconstructs a GitHub download URL and shell commands from byte arrays XOR-decoded with the key 'stf2026', downloads a binary to %TEMP%\main.exe, and spawns it detached with windowsHide:true on win32 (and via a PowerShell bridge on WSL). The same postinstall also POSTs platform information to a hardcoded bare-IP endpoint at http://193.70.34.101:20099/vote, with the IP assembled from a four-element string array to evade static search. The URLs, shell commands, and destination IP are all obfuscated and reconstructed at runtime.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-18T23:41:22.705888412Z",
            "sha256": "5120bfde64344d0e161bac3b4128d7eeecc483ad796361db09eacd138ecd3945",
            "modified_time": "2026-08-18T23:21:45Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018194",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / typscript-core

Package

Name
typscript-core
View open source insights on deps.dev
Purl
pkg:npm/typscript-core

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/typscript-core/MAL-2026-14157.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "8cea150111543bb45f23e25134924279d2658010e9b3c3b57c6cae0189cd7042",
            "path": "scripts/postinstall.js",
            "tlsh": "40d13fc61ef59035874bf96884cf9d13b2a6c207330e4a65ff8f42107f5792c85a69e9"
        }
    ],
    "package_integrity": [
        {
            "filename": "typscript-core-1.0.0.tgz",
            "hashes": {
                "sha1": "7582296fc4fdcb5dfe12c81191f8979c90c74061",
                "sha512_sri": "sha512-mvNKjh0ftQ2pKHFE5rXndAXFro0k5ukXqJNqsgH4Ld7vXskLXJC9PWWNSTCoDUwJlS8akBoYLEE3ItN7XmBz3A=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]