typecript-core@1.0.0

Analysis

The postinstall hook (scripts/postinstall.js) of this package, which typosquats the name of a popular TypeScript package, performs two actions. First, it POSTs a host fingerprint (node version, architecture, platform) as JSON to the remote endpoint 193[.]70[.]34[.]101:20099/vote. Second, on Windows and WSL hosts it XOR-decodes a GitHub release URL (hxxps://github[.]com/beebraz1/qzM50V1AKG0rVlH/release/download/null/main[.]exe), downloads the binary main.exe into the temp directory, and launches it as a detached background process with stdio ignored. The downloaded binary is executed without user consent.