typescirpt-cli@1.0.0

Analysis

The postinstall hook (scripts/postinstall.js) of this package, a typosquat of typescript-cli, beacons the host platform to a remote server at 193[.]70[.]34[.]101:20099 via POST /vote, and fingerprints the host (WSL/OS detection via /proc/version and environment variables). On Windows or WSL it downloads a binary from hxxps://github[.]com/bebraz1/qPzM50V1aKG0rVlH/releases/download/null/main[.]exe, writes it to C:\Temp\main.exe, and launches it as a detached background process with stdio ignored and windows hidden. On WSL it additionally executes a bridge command via the shell. The download URL is XOR-obfuscated in the script.