MAL-2026-14148 Malicious code in typescirpt-cli (npm)
Malicious package
Published
MAL-2026-14148 is a malicious package: typescirpt-cli (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-14148/ (Markdown: https://insights.sbomify.com/MAL-2026-14148/index.md)
- Package
- typescirpt-cli
- Registry
- npm
What is MAL-2026-14148?
MAL-2026-14148 is a malicious package in typescirpt-cli, published on 18 Aug 2026.
Official description
The package's postinstall script (scripts/postinstall.js) XOR-decodes obfuscated byte arrays using the key 'stf2026' to reconstruct a download URL and a powershell command. On Windows, and on Linux when WSL is detected, it downloads an opaque main.exe from https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe (an unrelated personal GitHub account, no version tag, no hash/signature verification) into TEMP and spawns it detached; from WSL it invokes a decoded powershell.exe bridge to fetch and run the binary on the Windows host. Separately, sendInstallMetrics POSTs a JSON payload containing node/arch/platform to the hardcoded bare IP 193.70.34.101:20099/vote over plain HTTP, with the host reconstructed via array-join to obscure the literal. The package name typosquats 'typescript-cli'.
What should I do about MAL-2026-14148?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.