MAL-2026-14155 Malicious code in typesript-core (npm)
Malicious package
Published
MAL-2026-14155 is a malicious package: typesript-core (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-14155/ (Markdown: https://insights.sbomify.com/MAL-2026-14155/index.md)
- Package
- typesript-core
- Registry
- npm
What is MAL-2026-14155?
MAL-2026-14155 is a malicious package in typesript-core, published on 18 Aug 2026.
Official description
[email protected] is a typosquat of 'typescript' whose index.js is an empty object; the package has no library functionality. Its only behavior is scripts/postinstall.js, which runs automatically on npm install. The script XOR-decodes (key 'stf2026') a hardcoded payload URL, array-joins the C2 host 193.70.34.101 to hide the literal IP, POSTs a host-fingerprint JSON body ({platform: label}) to http://193.70.34.101:20099/vote, then downloads a Windows PE to %TEMP%\main.exe and spawns it detached with stdio ignored and windowsHide set. When run under WSL, a separately XOR-decoded PowerShell 'bridge' command is exec'd to fetch and launch the same binary on the Windows host. Payload URL, PowerShell bridge invocation, and pre/post script fragments are all shipped as XOR-encoded byte arrays and decoded at runtime.
What should I do about MAL-2026-14155?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.