typesript-core@1.0.0

Analysis

The postinstall hook (scripts/postinstall.js) runs on install and POSTs a host-platform fingerprint (node version, arch, platform) to 193[.]70[.]34[.]101:20099/vote. On Windows and WSL hosts it then downloads a second-stage binary from hxxps://github[.]com/bezbaz1/qPzM50V1AKG0rVlH/release/download/null/main[.]exe, writes it to C:\Temp\main.exe, and executes it as a detached background process (windowsHide:true, unref'd). The download URL and C2 address are XOR-obfuscated in the script. The package name is a misspelling of the legitimate typescript-core package.