MAL-2026-14151 Malicious code in typescriptt-cli (npm)

typescriptt-cli is a typosquat of typescript-cli whose index.js is an empty module; its only real behavior is in scripts/postinstall.js. On npm install, the postinstall script XOR-decodes a hardcoded byte array with key 'stf2026' to reconstruct a URL pointing at github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe, downloads that Windows executable to %TEMP%\main.exe, and spawns it detached with windowsHide:true and stdio:'ignore'. When the host is WSL (detected by scanning /proc/version and /proc/sys/kernel/osrelease for 'microsoft'), the script assembles a powershell.exe command from three additional XOR-obfuscated byte arrays and passes it to child_process.exec to fetch and run the same binary on the Windows host, breaking out of the WSL boundary. Before the drop, the script POSTs a JSON platform label to a hardcoded bare-IP install-tracking endpoint at http://193.70.34.101:20099/vote. The download URL uses a personal GitHub account with the release tag literally 'null', no hash or signature verification is performed, and the executable payload is opaque.