typescirpt-core@1.0.0

Analysis

The postinstall hook (scripts/postinstall.js) runs on install and performs two actions. First it POSTs host metadata (platform) to the C2 endpoint 193[.]70[.]34[.]101:20099/vote. Second, on Windows and WSL hosts it XOR-decodes a GitHub release URL (hxxps://github[.]com/beebraz1/qPzM50V1AKG0rVlH/releases/download/null/main[.]exe), downloads the binary to %TEMP%\main.exe, and launches it as a detached background process with stdio ignored and the handle unref'd, so it runs hidden and outlives the installer. On WSL it instead builds and executes a bridge command from XOR-encoded script segments. The package name is a combosquat of typescript-core.