typescriptt-cli@1.0.0

Analysis

The postinstall hook of typescriptt-cli (a typosquat of the typescript package) runs a script that fingerprints the host (platform, architecture, Node version, WSL detection) and POSTs it to 193[.]70[.]34[.]101:20099/vote. It then XOR-decodes a GitHub-hosted binary URL, downloads the binary to the temp directory as main.exe, and spawns it detached so it runs in the background. On WSL/Windows it executes a decoded bridge command to launch the downloaded payload. The package ships no actual CLI functionality; its only behaviour is the install-time download-and-execute of a remote binary and beaconing to the C2 host.