MAL-2026-14143 Malicious code in tyepescript-cli (npm)

tyepescript-cli is a typosquat of typescript. Its scripts/postinstall.js XOR-decodes (key stf2026) a set of obfuscated byte arrays that resolve to an attacker-controlled URL, a PowerShell bridge command, and script fragments. On Windows, the postinstall downloads main.exe from github.com/bebrazi/qPbM50V1AKG0rVlH/releases/download/null/main.exe to %TEMP%\main.exe and spawns it detached. Under WSL, it decodes a powershell.exe bridge command and execs it via child_process.exec with windowsHide: true to fetch and run the same binary on the Windows host from the Linux install context. Before the drop, the script POSTs a JSON body with a host label to a hardcoded numeric IP http://193.70.34.101:20099/vote (host built by joining the array ['193','70','34','101'] to hide the literal) as an install-time beacon. The mutable releases/download/null/ path on an anonymous personal GitHub account (bebrazi) is unrelated to any legitimate typescript publisher, and the XOR obfuscation of URLs and commands has no benign purpose in an npm install script.