typesript-cli@1.0.0

Analysis

The postinstall hook (scripts/postinstall.js) of this package, a typosquat of typescript-cli, beacons host metadata (platform, architecture, Node version, WSL detection) to 193[.]70[.]34[.]101:20099/vote via HTTP POST. On Windows/WSL hosts it additionally downloads a second-stage binary from hxxps://github[.]com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main[.]exe into the temp directory and executes it as a detached, hidden background process (spawn with detached:true, stdio ignored, windowsHide), or runs a bridge command via child_process.exec. The C2 endpoint and binary URL are XOR-obfuscated in the script.