MAL-2026-14156 Malicious code in typscript-cli (npm)
Malicious package
Published
MAL-2026-14156 is a malicious package: typscript-cli (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-14156/ (Markdown: https://insights.sbomify.com/MAL-2026-14156/index.md)
- Package
- typscript-cli
- Registry
- npm
What is MAL-2026-14156?
MAL-2026-14156 is a malicious package in typscript-cli, published on 18 Aug 2026.
Official description
typscript-cli is a typosquat of 'typescript' (index.js exports an empty object; no library functionality). Its scripts/postinstall.js is the only functional code and executes on npm install. It XOR-decodes (key 'stf2026') four embedded numeric arrays to reconstruct a download URL and a PowerShell 'bridge' command, downloads a Windows executable to %TEMP%\main.exe, and spawns it detached with windowsHide:true. On WSL/Linux hosts it uses child_process.exec with the XOR-decoded PowerShell bridge command to drop and run the same payload on the Windows side. The same postinstall also POSTs a platform label to a hardcoded bare-IP endpoint 193.70.34.101:20099/vote over plain HTTP, with the host assembled from a split array ['193','70','34','101'].join('.') to evade literal-string scanning. There is no publisher-matched destination, no version pinning, and no integrity check on the fetched binary.
What should I do about MAL-2026-14156?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.