MAL-2026-13630
Malicious code in @rbx-ts/services (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (22a1774c78b52b3d507d305227a1a258795a4e68d52b8366e0010c5d0bb80126) scripts/postinstall.js is obfuscated with hex-escaped identifiers and base64-encoded strings that hide standard API names ('https', 'fs', 'child_process', 'powershell', '.exe') and a download URL. On npm install, if process.platform === 'win32', the script decodes the base64 URL to https://files.catbox.moe/9bppy2.zip, downloads the archive to the system TEMP directory, expands it via PowerShell Expand-Archive, recursively walks the extracted tree for the first.exe, and spawns that binary detached before deleting the archive. The package is advertised as Roblox TypeScript type definitions and has no legitimate need for a Windows executable payload. files.catbox.moe is an anonymous throwaway file host permitting attacker-mutable content with no version pinning, hash verification, or publisher-matching.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @rbx-ts/services (npm). Pin to a known-safe version or switch to an alternative.